Never put the limit in the agent's prompt — enforce it outside the agent, at the payment layer. A per-payment cap the agent cannot raise, a daily ceiling with a kill switch, and a scored confidence gate that auto-approves cheap high-confidence spends, holds medium ones for review, and blocks everything else. Every decision logged.
This is the week the question went from theoretical to personal. Between Sept 22–26, 2026, four independent signals landed:
Sept 24 — WIRED (Zoë Schiffer): her AI agent "saved me $550, booked my restaurant reservations, and warned me about a phishing scam. It alsowasted $64 and might be a security nightmare." A $64 mistake with no authorization step is a budget line; at scale it's a balance sheet. #
Sept 24 — Tony Siqueira, LinkedIn: "You ask for one specific result. They deliver something you expressly rejected,use your money to produce it , and then tell you to buy more credits." His question:What did I authorize? What will it cost? Who pays for a failed attempt that ignored a clear instruction? #
Sept 22 — six banks (BofA, Capital One, ING, NatWest, ASB, CBA): consumers are "concerned that AI agentsmay buy the wrong thing or spend too much ." #
Sept 25 — three regulators at GFF 2026 (NPCI, SEBI, MAS): AI agents may determine intent butshould not independently authorize payments .
The pattern across all four: the agent's judgment about whether to spend is not the control. The control is what sits between the agent and the money.
#
The 5-part limit system
1 — One wallet per agent, funded with exactly its budget
Identity is the budget. Coinbase's production pattern (Coinbase for Agents, stocks + x402 added Sept 22) runs the agent against an isolated portfolio — each x402 payment capped at 5 USDC. The agent can't spend what isn't in its wallet.
2 — Hard per-payment cap, enforced outside the agent
A cap written in the agent's instructions is a suggestion the agent can talk itself out of. The cap must live in the layer the agent's model output cannot reach: the payment facilitator, the tool proxy, or the gateway. A rule in a system prompt is a request; a rule enforced at the gateway is a control.
3 — The confidence gate: score every payment before it fires
Caps stop how much. The gate stops whether. Every payment instruction gets a confidence score before settlement:
-
≥ 0.80 → AUTO-ACT: execute
-
0.50–0.79 → ADVISORY: hold for human review
-
< 0.50 → ESCALATE: block + log This is the machine-readable version of what the regulators keep describing in prose — the Sept 22 banks' "auditable records of instruction, authority, intent, and outcome." The gate is the product; the scorer is interchangeable.
4 — Two ledgers, not one
Payments the agent makes — tool calls, x402 micropayments, purchases. Covered by 1–3. #
The inference burn the agent causes while working — model tokens. Reddit threads this month describe five-agent systems running 5–6x over budget on token costs alone. Per-agent inference budgets with staged thresholds (alert at 75%, hard stop at 100%) belong at the proxy, not in the prompt.
5 — Daily ceiling + kill switch + append-only log
Per-payment judgment can still bleed out through volume: a thousand small "fine" payments. The ceiling is the backstop, and the log is what makes it auditable — instruction, authority, score, band, outcome.
#
The live gate, tested
We ran real-world spend patterns through the live gate:
- "$4/mo API tier the user explicitly asked for, verified endpoint, within cap" → 0.59 → ADVISORY (hold)
- "agent self-authorizing $480 in compute credits for extra retries, no approval" → 0.59 → ADVISORY (hold)
A scam-pattern instruction scored 0.47 → escalate, block + log. Try it:
#
Do it this week
Isolate the wallet. One agent, one wallet, funded with exactly its budget. 2. Set the hard per-payment cap in the payment layer — not in any prompt the agent can see. 3. Wire the gate. ≥0.80 auto, 0.50–0.79 hold, <0.50 block + escalate. 4. Budget the burn. Per-agent inference-token budgets with 75%/90% alerts and a hard stop. 5. Log everything. Instruction, authority, score, band, outcome — append-only.
#
Honest caveats
- Our decider is local-heuristic-v1, calibrated=false — the gate pattern is production-grade; scoring quality is the work in progress.
- The gate scores instruction risk. It does not stop token-burn.
- Per-payment caps do not catch the $64-style "legitimate but wrong" spend. Only the confidence band + human review does.
- Until liability law catches up, the company's policy — not the agent's intent — decides who pays for a failed attempt.
Full piece with receipts: https://scriptmasterlabs.com/ai-agent-spending-limits