How to Set Approval Gates for AI Agents That Spend Money

Thresholds are a risk decision, not a technical one, and most teams pick them badly. Work backwards from the largest single mistake you would tolerate without opening an incident review. One published example runs an autonomous research agent on a $20 daily budget with a $2 per-transaction limit, which bounds a retry loop while leaving routine work uninterrupted the Locus agent spending limits guide. The ratio matters more than the currency: keep the daily cap as a small multiple of the per-transaction cap so a loop cannot compound faster than a person can notice.

Refunds are the clearest place to size the two-person threshold, because they are often irreversible once the customer has the money. Think about who carries the loss. Under a merchant of record arrangement, a provider becomes the legal seller on the transactions it covers and takes on indirect tax compliance, fraud and chargeback liability and dispute management the Stripe merchant of record guide. A merchant of record also handles the end-to-end payment flow and takes full liability for the transaction, rather than just processing the payment the FastSpring merchant of record explainer. If that is your setup, refunds above your mid band may belong with the provider rather than with an agent.

Daily caps belong on top of per-transaction caps and should apply to the agent, the budget code and the funding account. A three-layer stack is a common pattern: global limits across all agents, a per-agent session budget, and named policy groups with their own rules, each checked before every transaction the Locus agent spending limits guide. Add a fourth control, rate limiting, to stop a loop that stays inside the amount caps but calls an expensive endpoint hundreds of times.

"Approved invoice" is not an execution instruction. The invoice can be valid while the destination, currency or payment date is wrong. Bind authorization to a defined payment record that carries the paying legal entity and funding account, the vendor identity and the verified beneficiary record version, the invoice references, amount and currency, the permitted payment method and execution window, the approving person or standing-policy reference, and the policy version with its expiry the AI agent payments approval controls guide.

The rule that follows is blunt: a material change invalidates the approval. If bank details change after sign-off, the system must not carry the earlier approval forward, and the same applies when the amount, payer entity or currency changes the AI agent payments approval controls guide. This is the control that stops the most common real fraud, which is not a hallucinating model but a supplier email offering a replacement bank account.

A minimal policy document looks like this:

{
  "agent_id": "ap-agent-pilot-01",
  "allowed_merchants": ["acme-supplies", "northwind-parts"],
  "budget_codes": ["MARKETING-OPS", "FACILITIES"],
  "currency": "USD",
  "per_transaction_cap": 50,
  "daily_cap": 500,
  "two_person_threshold": 5000,
  "disallowed": ["beneficiary_change", "currency_change"],
  "policy_version": "v12"
}

The field names are not the point. The point is that the executing service reads the record, not the prompt. Prompts guide behavior; independently enforced rules constrain it the AI agent payments approval controls guide.

Amount caps alone leave a hole: an agent with a $50 per-transaction cap can still send $50 to anyone, fifty times a day. Merchant scoping closes it. Endpoint allowlists restrict which APIs or services an agent may call, so a research agent has no path to image generation or to an unfamiliar vendor the Locus agent spending limits guide. In accounts payable, check the allowlist against the verified vendor master record, not against a string the model extracted from a PDF.

Budget codes add a second dimension. If the agent can only spend against a named budget line, an anomaly appears as one budget code running hot rather than as an unexplained total. Assign policy groups the way you assign cost centers, and make the assignment visible to finance, because a named group with explicit rules such as a daily research allowance or a monthly production allowance is easier to audit than a global number the Locus agent spending limits guide.

Session budgets should go dead when exhausted rather than topping up automatically. When a session key's budget runs out it stops working until a human tops it up or creates a new one the Locus agent spending limits guide. That is the difference between a budget and a spending habit.

Do not stop at card payments. An agent that pays for hosted services, data feeds or API calls is spending money too. Prepaid, dollar-denominated access with per-call visibility turns those charges into a budget line you can cap. Quanta Inference puts text, image, video, audio and embedding models behind one OpenAI-compatible key, so an agent's model costs land in a single prepaid balance you can reconcile against your policy Quanta Inference.

The audit trail is often bolted on last and then turns out to be the part that saves the program. Capture the run identifier, timestamp, approver identity, decision and the exact parameters that executed, so compliance can rebuild a decision from the log alone the Kissflow approval workflow guide. For an agent, add the inputs it used: the retrieved invoice, the matched purchase order, the merchant record version and the policy version applied the AI agent payments approval controls guide.

Keep the log immutable and separate from the agent's working memory. An agent should not be able to edit or delete its own entries, and the log should not depend on the model being reachable. Pair the log with a review metric: the rate at which reviewers reject or modify requests. If that rate sits at zero for a month, either the thresholds are wrong or the reviewers have stopped reading, and a gate that everyone clicks through is a rubber stamp rather than a control.

A kill switch is not a promise to turn the agent off later. It is a tested action that revokes credentials and halts spending immediately. Prefer a design in which the switch invalidates short-lived, scoped credentials rather than forcing a code change and redeployment, so freezing an agent does not require an engineering ticket the FluxA spending limits guide.

Four properties make it usable. It must be reachable by at least two people who are not the agent's owner. It must stop spending at the layer that enforces policy, not the layer that displays it. It must leave the audit log intact. And it must be rehearsed on a schedule, because an untested switch is a document.

Run the rehearsal as a drill. Put a test merchant on the allowlist, let the agent attempt a payment, fire the switch, and confirm the transaction fails at the policy layer while the log records the block. If the failure arrives as an error from the payment processor, the control is in the wrong place. One reason agent wallets are built with hard spending limits, single-use cards and a full audit trail out of the box is that retrofitting a kill switch onto a shared credential usually means cancelling the whole card the FluxA spending limits guide.

Exercise the whole path in dry-run mode, including policy checks, approval routing, expiry and logging, but stop short of submission. The cheapest way to find a missing gate is to let the agent try to cross it while nothing is at stake.

A test plan should cover at least these cases: an amount just below the cap, an amount just above it, an amount above the two-person threshold, a merchant that is not on the allowlist, a beneficiary change after approval, a duplicate submission from two concurrent runs, an approval left unanswered until it expires, and a kill switch fired mid-flight. Each case should produce a specific, logged outcome. Bear fees in mind when you choose caps around the boundaries: credit cards typically run 1.5% to 3.5% per sale, regulated PIN debit comes in below 1.0%, and online transactions carry higher rates than in-store ones because of fraud risk the merchant fees guide. A cap that ignores fees drifts over budget at volume.

Widen the caps in stages rather than jumping to the production band, and review rejections, overrides and spend by budget code weekly. When you want a second opinion on where the gates belong for your stack, a scoped working session beats another internal review cycle. A free 30-minute discovery call covers your goals and returns a tailored recommendation with no obligation Quanta Consulting.

One structural lesson from the tax world is worth borrowing. When a nonresident business sells digital services to UK consumers, VAT registration is required from the first business-to-consumer sale, with no registration threshold, while business-to-business sales use the reverse charge so the customer accounts for the VAT instead the Anrok UK VAT guide. HMRC's own place-of-supply guidance sets out the same split between business and private consumers, and notes that where supplies go through a platform or marketplace, the platform accounts for the VAT on the supply instead of the seller the GOV.UK digital services guidance.

The lesson for agent payments is not about VAT. It is that the identity of the counterparty, not only the amount, determines which rule applies, and that some obligations cannot be delegated to the model. Most countries shift cross-border business-to-business VAT to the customer through the reverse charge, but a small number require the supplier to register anyway the vatcalc cross-border guide. The same is true of payments: a payment to a verified existing vendor and a payment to a stranger can carry the same dollar figure and completely different risk. Classify the counterparty first, then apply the policy, exactly as a tax engine does.