Answers · agent payments
How do I give each AI agent its own spend policy that expires with the task, plus per-task caps and auto-expiring approvals?
Last updated
TL;DR: Make the spend policy an object with a lifetime, not a standing setting. For each agent and task: issue a separate credential, attach a policy with a per-purchase cap, a total for the task, an allowlist of merchants or categories, and an expires_at that matches the task's end. Have the agent check every purchase against that policy at payment time. When the task ends, the policy expires and further purchases are denied by default, with no one needing to remember to turn it off. Anything over the cap goes to a human as a one-time approval with a short expiry, bound to the exact amount and payee, so a yes can't be reused for a later or larger charge. Keep the policy versions, decisions and approvals outside the agent's editable session so the agent can't raise its own limits.
What should I check, step by step?
1. One credential per agent (and per task if tasks run in parallel). A shared key means shared caps, and revoking it stops everything.
- Write the policy per credential: currency, per-purchase max, a total for the task (or daily max for short tasks), allowed merchant domains and categories, and expires_at set to the task deadline.
- Fail closed: no policy, an expired policy, or a revoked credential means deny, not allow with a warning.
- Check at payment time, not at plan time: the agent (or your payment hook) asks for an allow/deny decision with the exact amount and merchant right before paying, and aborts on deny.
- Above the cap, request a one-time human approval bound to a hash of the exact purchase (amount, currency, merchant, item) with a short expiry, for example 15 to 60 minutes. Don't raise the policy for the rest of the task.
- Before paying on an approval, verify the decision receipt matches the purchase. A changed amount or payee needs a new approval.
- When the task finishes early, revoke the credential or set a new policy that expires now. Don't wait for the clock.
- Keep every policy version, allow/deny decision and approval in a store the agent can't edit, so you can show later what limit applied to each charge.
Why should an agent's spend policy expire with the task?
Standing budgets outlive the work they were meant for. An agent given $50/day for a research task still has $50/day next week, unless someone removes it.
- A policy with expires_at turns cleanup into a default: when the task deadline passes, purchase checks return policy_expired and the agent stops spending even if nobody touches the config.
- Per-agent provider budgets (an OpenAI project spend limit, a Claude workspace limit, a key cap on OpenRouter) are a useful outer ceiling, but they reset monthly or daily and aren't scoped to one task. Use them as a backstop above the task policy, not as the policy.
- On a card or wallet, put hard limits on the instrument too (for example Stripe Issuing spending_controls, or a small dedicated wallet). The task policy decides each purchase; the instrument limit caps the damage if the check is skipped.
How do I check per-task caps at payment time?
A cap written in the prompt or a config file the agent can edit is advice, not a cap. The check has to run outside the agent and return a decision the payment step obeys.
- Check the exact purchase immediately before it settles: amount in minor units, currency, merchant domain and category, plus a reference such as the task or run id so totals and audits line up.
- Count only allowed purchases toward the running total, and expect a small overshoot when several calls are in flight at once. Leave headroom or serialize payments for tight budgets.
- Return reasons with each deny (over_per_transaction_cap, over_daily_cap, merchant_not_allowed, category_not_allowed, policy_expired, credential_revoked) so the agent can stop or ask for approval instead of retrying blindly.
How do I make agent spend approvals expire and not be reused?
Bind each approval to a hash of the exact action. If the agent later wants a different amount, payee or item, the hash won't match and the old yes doesn't apply.
- Give approvals a short expiry and make them single-use. An approval that sits for a day while prices or context change is no longer the decision the person made.
- Agent frameworks will pause for approval (for example the OpenAI Agents SDK's needsApproval interruptions), but they generally don't expire the pending approval for you. Your approval store or queue has to own the clock.
- The agent may request an approval but must not be able to decide one. Only the owner's credentials should approve, and the decision should be signed and timestamped.
What can go wrong?
The task ends but the agent's policy doesn't; a later prompt injection spends the leftover budget.
- Two agents share one credential, so one agent's loop uses up the other's budget and revoking it stops both.
- An approval for $40 is reused for a $400 charge because it was recorded as "approved: true" without the amount.
- The cap is checked when the plan is made, and the price changes before checkout.
- The agent can write to the file holding its own limits and raises them mid-task.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Set a spending policy on my research agent's credential for this task only: at most 2.00 USD per purchase and 15.00 USD a day, only at api.example-data.com, expiring when the task ends tonight at 23:59 UTC.”
{
"tool": "set_spend_policy",
"arguments": {
"credential_id": "<this agent's credential id>",
"currency": "USD",
"per_tx_max_minor": 200,
"daily_max_minor": 1500,
"allowed_domains": [
"api.example-data.com"
],
"expires_at": "2026-11-07T23:59:00Z"
}
}- Needs your owner account key (MCP toolset=trust). The policy replaces the previous one, and every version stays on Rightshold's ledger. After expires_at, authorize_spend denies with policy_expired; with no policy at all it denies with no_spending_policy.
- authorize_spend checks each purchase against the policy and the running daily total (resets 00:00 UTC) and returns a signed allow or deny with reasons. It records decisions only and never moves money, so your payment code must stop on deny.
- request_human_approval for anything over the cap: send the exact purchase as action, the credential_id and expires_in_minutes (for example 30). The owner decides once with decide_human_approval; verify_human_approval (free) checks the receipt matches the purchase before you pay.
- revoke_agent_credential ends a credential at once if the task is cancelled early.
Rightshold records spend policies, allow/deny decisions and human approvals for agents that call it, and signs each one. It never moves money, doesn't sit between your agent and the merchant, and can't stop a payment your code makes without checking. Enforce the decision in your payment hook and put hard limits on the card or wallet too. Not financial advice.
What are the sources?
- Stripe Docs: Issuing for agents (spend controls; real-time authorization)
- Stripe Docs: Issuing real-time authorizations (issuing_authorization.request; respond within 2 seconds)
- Coinbase CDP SDK: SpendControls (maxAmountPerPayment, maxCumulativeSpend, SpendStore)
- OpenAI Agents SDK (JS): Human-in-the-loop (needsApproval, interruptions)
- Claude Agent SDK: How the agent loop works (turns and budget, budget headroom)
Related
- How to give each AI agent its own budget for paid APIs
- How to gate an agent wallet or card with per-task caps and an outside spend record
- How to put expiry and timed re-approval on agent escalation thresholds
- How to require human approval before an AI agent spends money
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'