How do I require quote-bound approval before an agent payment settles?

What should I check, step by step?

1. Issue a dedicated card or wallet per agent (or per high-risk workflow). Fund only what that workflow may spend; never hand over the company treasury key.

2. Set instrument-level ceilings first (per-authorization and period caps, allowed merchants/categories). Stripe Issuing spending_controls and wallet signing policies reject over-cap attempts even if the model forgets the prompt.
3. When a vendor returns a quote or 402/price, freeze quote_id (or cart hash), amount_minor, currency, payee, and expiry into server storage the agent cannot UPDATE.
4. Call request_human_approval with those exact fields in action. Show the approver the quote fields from the payment request, not the model's paraphrase.
5. Before settlement: verify_human_approval against the live quote hash; run authorize_spend (or your issuer's real-time auth) against set_spend_policy; refuse if amount, payee, or quote_id drifted.
6. Settle only after both checks pass. Use an idempotency key so a resumed or retried run cannot pay the same quote twice.
7. Append every approve, deny, timeout, and settlement receipt outside the agent session (ledger or server DB). Keep only receipt ids in chat memory.
8. Expire stale quotes and approvals; a yes for quote Q1 is not a warrant for Q2 after a price change.

Dedicated wallet, narrow limits, then a quote-bound yes

A shared corporate card with "ask before big purchases" in the system prompt fails open under prompt injection or a hurried alwaysApprove. Isolate funds and enforce ceilings on the instrument.

• Stripe Issuing for agents documents spend controls at card creation (and updates later), plus real-time authorization so your code can approve or decline from task context — including amount confirmation against the expected budget for the order — before the charge lands.
• set_spend_policy on a Rightshold credential sets per_tx_max_minor, daily_max_minor, allowed_domains/categories, and optional expires_at. authorize_spend returns a signed allow/deny against that policy; it records decisions only and never moves money.
• The human yes is a third layer: bind it to quote_id, amount_minor, currency, and payee so a higher requote or a swapped merchant needs a new approval.

Re-check the quote at settlement, not only at ask time

Prices move. Between approval and capture the vendor may return a new total, a different token, or another payTo address. Re-hash the live quote and compare to the approved action; on mismatch, fail closed and open a new request_human_approval.

• OpenAI's Agents SDK keeps approval state on the server for browser/mobile UIs; do not treat a client-uploaded RunState or an agent-written approved_quote.json as authorization.
• Stripe's issuing_authorization.request path is for code checks you already prepared (approved quote hash, task budget), not for paging a human inside the ~2 second window — get the quote-bound yes first, then let settlement run under that grant.
• Write allow/deny and the settlement reference to append-only storage. How to gate an agent wallet or card with per-task caps covers task budgets and revoke; this page is specifically about binding the yes to one quote before money moves.

What can go wrong?

Approval screen shows "about $40 for supplies" while the quote is 42.17 USD to a different merchant legal name.

• Quote expires or is replaced; the agent reuses the old approval id because nothing compared quote_id or amount_minor at capture.
• Real-time auth times out and the card's default is approve; for agent cards, configure timeout to decline and keep the webhook fast.
• Settlement CSV lives in the workspace where the agent can delete the deny row after a bad payment.