Letting AI agents pay for things without losing control
An AI agent that can book, buy, or top-up needs actual spending power - which today means handing it a card or an API key and hoping. The useful middle ground is a policy layer between the agent and your money.
The problem with a raw key
Give an agent a payment credential and every failure mode is yours: a loop that retries a purchase, a prompt injection that tells it to "upgrade the plan", a budget that was supposed to be per-task but is really per-key. The credential does not know the difference between a $9 top-up you wanted and a $900 charge you did not.
What a payment policy layer does
A gateway sits between the agent and the money and enforces rules before any charge happens:
- Spending limits - max per transaction, per day, per session.
- Category and merchant rules - API credits and hosting yes, gambling and gift cards no.
- Human approvals - charges above a threshold or outside a category wait for a person's click.
- Idempotency - a retried charge is the same charge, not a second one.
- Audit trail - every decision, allowed or denied, with the reason - the receipt for "why did the agent do that".
What a sensible setup looks like
- Start with the agent as a proposal-generator: it creates payment requests, a human approves each one. Trust is earned, not granted.
- Auto-approve the boring tail - small amounts in known categories - once the agent proves itself.
- Keep a hard ceiling - a session or daily budget the agent cannot exceed no matter what.
- Scope credentials - the agent's key allows only what its role needs, separate from approver and operator keys.
SanestlyPay is our open-source implementation: a local-first policy gateway with limits, approvals, budgets, HMAC signing and a full audit trail - plus SDKs and a mock Playground you can try without a real card.
