How do I temporarily pause an AI agent's spend without revoking its credential?

What should I check, step by step?

1. Decide that you want a pause, not a revoke. If the key may be compromised or the agent is acting maliciously, revoke instead (revoke_agent can't be undone). A pause is for situations where you trust the credential and want to resume later.

2. Save the current policy first: GET /v1/spend/policies/{credential_id} returns the live policy and spent_today_minor, so you can record the same rules again on resume.
3. Pause with a new set_spend_policy version: per_tx_max_minor 0, daily_max_minor 0, and allowed_domains holding one placeholder domain such as paused.invalid. Any positive amount returns over_per_transaction_cap and over_daily_cap, and every real merchant returns merchant_not_allowed.
4. Don't pause by clearing the allowlist. An empty allowed_domains or allowed_categories list means no restriction, so clearing the list widens spend instead of stopping it.
5. For a planned, time-boxed window, set expires_at on the live policy instead. After that time, authorize_spend returns policy_expired until you record a new policy. expires_at must be in the future when you set it.
6. Pause the money rails too: set a Stripe Issuing card to inactive (authorizations decline with card_inactive, and you can set it back to active later). Never use canceled for a pause, because it is permanent. Pause or disable the wallet key or payment-provider key the agent uses.
7. If the whole Rightshold account should stop (credit spending, new listings, new work), use account_controls freeze with a reason, then unfreeze when you're done. It does not change authorize_spend answers by itself, so keep the policy pause in place.
8. Resume by recording the saved policy again (a new version), setting the card back to active and unfreezing. Then confirm one authorize_spend allow. Test both directions: while paused, one deny; after resume, one allow, on the same credential.

What is the difference between pausing and revoking an AI agent's spend authority?

revoke_agent is a permanent cut. Every Rightshold check refuses the credential from that moment, and resuming means a new credential, a new key and a fresh reputation. The page on revoking spend authority mid-task covers that path for when trust is gone.

• A pause keeps the credential, its key and its track record, and stops new spend decisions from returning allow. That fits incidents where the agent is fine but the situation isn't: a vendor outage, a disputed invoice, an audit, or an owner who wants to look at the run before more money moves.
• NIST SP 800-53 Rev. 5 AC-2(3) (disable accounts) and AC-3 (access enforcement) treat disabling access as different from deleting it. EU AI Act Article 14 expects oversight people who can step in and stop a system. A recorded, reversible pause is that step for agent spend.

How do I pause an AI agent's spend with a deny-all policy version or expires_at?

set_spend_policy records a new version that replaces the old one from the moment it is recorded. A deny-all version (caps of 0, allowlist of paused.invalid) makes authorize_spend return a signed deny with over_per_transaction_cap, over_daily_cap and merchant_not_allowed for any real purchase.

• expires_at lets the pause start on its own: after the timestamp, authorize_spend adds policy_expired. That suits a policy that should only last for a sprint or a promotion. To pause right away, record the deny-all version, because expires_at must be in the future when it is set.
• Don't pause by sending an empty allowlist. Empty allowed_domains and allowed_categories mean no restriction, so that change widens spend. Keep the paused version and the saved live version side by side so resuming is one call.

How do I pause an AI agent's card and account, then resume spend safely?

Rightshold signs decisions but does not hold the agent's card or wallet. Set a Stripe Issuing card to inactive (it declines with card_inactive and can be set back to active). Canceled is permanent, so keep it for a revoke. Pause or disable any wallet or provider key the agent holds.

• account_controls freeze stops credit spending, new listings and new work on the Rightshold account until the owner unfreezes. Use it when the pause covers the whole account, together with the policy pause that governs authorize_spend.
• Resume in order: record the saved policy again, set the card back to active, unfreeze, then run one authorize_spend and confirm it allows. Every pause and resume is a ledger entry, and ledger_verify is free and keyless.