How do I stop an AI agent from overspending?

Enforce spend policy outside the agent, at the payment layer — never in the agent's prompt. Give each agent its own wallet funded with exactly its budget, set a hard per-payment cap the agent cannot raise, run every payment instruction through a scored confidence gate (≥0.80 auto-execute, 0.50–0.79 hold for review, <0.50 block and escalate), and add a daily ceiling with a kill switch. Log every decision append-only.

What did the banks say about AI agents and spending?

On Sept 22, 2026, six banks (Bank of America, Capital One, ING, NatWest, ASB Bank, Commonwealth Bank of Australia) published 'Building Trust in Agentic Commerce,' warning that 'consumers are unclear if AI agents will act in their interests' and are 'concerned that AI agents may buy the wrong thing or spend too much — or even worse, lose their money to scams and fraud.'

How much can an AI agent spend before it must ask a human?

There is no universal number — the limit should be per decision, not per agent. A working pattern: payments under the cap with confidence ≥0.80 auto-execute; 0.50–0.79 hold for human review; anything below 0.50 or above the cap is blocked and escalated. The threshold is a scored authorization layer between the agent's intent and the money, not a fixed dollar amount.

Should AI agent spend limits be in the system prompt?

No. A rule in a system prompt is a request; a rule enforced at the API gateway, tool proxy, or payment facilitator is a control. Prompt-level guardrails decay the moment agents delegate to subagents (constraint decay). Enforce limits in infrastructure the agent's model output cannot reach.

Do spend limits cover the AI agent's own token/API costs too?

They should. Agent spend has two ledgers: payments the agent makes to others (tool calls, x402 micropayments, purchases) and the inference-token burn the agent causes while working. Per-payment caps stop the first; per-agent inference budgets with thresholds (e.g. alerts at 75%/90%, hard stop at cap) stop the second. Both must be enforced outside the agent.

SCRIPTMASTERLABS · AGENT COMMERCE · SEP 26, 2026

How to Set Spending Limits for AI Agents

Q: What did the banks say about AI agents and spending?

On Sept 22, 2026, six banks (Bank of America, Capital One, ING, NatWest, ASB Bank, Commonwealth Bank of Australia) published 'Building Trust in Agentic Commerce,' warning that 'consumers are unclear if AI agents will act in their interests' and are 'concerned that AI agents may buy the wrong thing or spend too much — or even worse, lose their money to scams and fraud.'

Q: How much can an AI agent spend before it must ask a human?

There is no universal number — the limit should be per decision, not per agent. A working pattern: payments under the cap with confidence ≥0.80 auto-execute; 0.50–0.79 hold for human review; anything below 0.50 or above the cap is blocked and escalated. The threshold is a scored authorization layer between the agent's intent and the money, not a fixed dollar amount.

Q: Should AI agent spend limits be in the system prompt?

No. A rule in a system prompt is a request; a rule enforced at the API gateway, tool proxy, or payment facilitator is a control. Prompt-level guardrails decay the moment agents delegate to subagents (constraint decay). Enforce limits in infrastructure the agent's model output cannot reach.

Q: Do spend limits cover the AI agent's own token/API costs too?

They should. Agent spend has two ledgers: payments the agent makes to others (tool calls, x402 micropayments, purchases) and the inference-token burn the agent causes while working. Per-payment caps stop the first; per-agent inference budgets with thresholds (e.g. alerts at 75%/90%, hard stop at cap) stop the second. Both must be enforced outside the agent.

The short answer: never put the limit in the agent's prompt — enforce it outside the agent, at the payment layer. A per-payment cap the agent cannot raise, a daily ceiling with a kill switch, and a scored confidence gate that auto-approves cheap high-confidence spends, holds medium ones for review, and blocks + escalates everything else. Every decision logged.

This is the week the question went from theoretical to personal: a WIRED reporter says her AI agent saved her $550 and wasted $64; six banks warned agents "may buy the wrong thing or spend too much"; three regulators said agents shouldn't authorize payments alone. The working system is below — with a live gate you can test this afternoon.

Why this week: the receipts

SEPT 22–26, 2026 — FOUR INDEPENDENT SIGNALS

Sept 24 — WIRED (Zoë Schiffer): her AI agent "saved me $550, booked my restaurant reservations, and warned me about a phishing scam. It also wasted $64 and might be a security nightmare." Verdict: worth the risk — but the waste is the story. A $64 mistake with no authorization step is a budget line; at scale it's a balance sheet.
Sept 24 — Tony Siqueira, LinkedIn: "You ask for one specific result. They deliver something you expressly rejected, use your money to produce it, and then tell you to buy more credits if you want another attempt." His question: "What did I authorize? What will it cost? Who pays for a failed attempt that ignored a clear instruction?"
Sept 22 — six banks (BofA, Capital One, ING, NatWest, ASB, CBA): consumers are "concerned that AI agents may buy the wrong thing or spend too much — or even worse, lose their money to scams and fraud."
Sept 25 — three regulators at GFF 2026 (NPCI, SEBI, MAS): AI agents may determine intent but should not independently authorize payments. Full receipts on our morning piece.

The pattern across all four: the agent's judgment about whether to spend is not the control. The control is what sits between the agent and the money.

The field's answers — and what each lacks

Answer	What's missing
adadvisor.ai — "AI Media Buying Governance": max exposure, permission matrix, economic targets, append-only log, kill switch. (Sept 17)	Built for ad-buying, not agent payments. No per-payment decision mechanism, no live testable endpoint, no scored authorization layer — governance as checklist, not machinery.
Zakai, Medium — "Constraint Decay" (Sept 24): move rules out of the prompt into infrastructure; identity per agent, scope attenuation, limits on the tree, human approval for irreversibles.	Strong argument, but zero code, zero live test, and no spend-band mechanics — it says enforce at the gateway without showing what the gateway's decision looks like.
GitHub PRD docs (zega.ai, dot-org-ai "primitives"): spending-authority limits, token budgets, authority tiers in YAML.	Speculative vendor docs from products nobody has verified in production. No dates that matter, no live endpoint, no proof any of it survived contact with a real agent.

Nobody owns the piece this query actually needs: the exact mechanism that scores a payment instruction before money moves, tested live.

The 5-part limit system

1 — ONE WALLET PER AGENT, FUNDED WITH EXACTLY ITS BUDGET

Identity is the budget. Coinbase's production pattern for agents (Coinbase for Agents, stocks + x402 added Sept 22) runs the agent against an isolated portfolio the user funds — each x402 payment capped at 5 USDC, settled from retail USDC, irreversible. The agent can't spend what isn't in its wallet. Start here; everything below is the refinement.

2 — HARD PER-PAYMENT CAP, ENFORCED OUTSIDE THE AGENT

A cap written in the agent's instructions is a suggestion the agent can talk itself out of. The cap must live in the layer the agent's model output cannot reach: the payment facilitator, the tool proxy, or the gateway. As the Sept 24 "constraint decay" argument puts it: a rule in a system prompt is a request; a rule enforced at the gateway is a control. The agent proposes; the cap disposes.

3 — THE CONFIDENCE GATE: SCORE EVERY PAYMENT BEFORE IT FIRES

Caps stop how much. The gate stops whether. Every payment instruction gets a confidence score before settlement:

instruction → score confidence [0,1]
≥ 0.80 → AUTO-ACT: execute
0.50–0.79 → ADVISORY: hold for human review / escrow
< 0.50 → ESCALATE: block + log

This is the same mechanism regulators and banks keep describing in prose — the Sept 22 banks' "auditable records of instruction, authority, intent, and outcome," NPCI's intent/authorization/settlement split, Sygnum's "authorization layer." The gate is the machine-readable version of their sentences. This is the decision-gated payments pattern: the gate is the product, the scorer is interchangeable.

4 — TWO LEDGERS, NOT ONE

Agent spend has two ledgers and caps must cover both:

Payments the agent makes — tool calls, x402 micropayments, purchases. Covered by 1–3 above.
The inference burn the agent causes while working — model tokens. Reddit threads this month describe five-agent systems running 5–6x over budget on token costs alone, and ~$100 gone to a single deep-research run. Per-agent inference budgets with staged thresholds (alert at 75%, hard stop at 100%) belong at the proxy, not in the prompt.

Siqueira's "who pays for the failed attempt" is ledger two. A per-payment cap does nothing about a $64 waste that was technically "authorized" — only the confidence band (medium-confidence → hold for review) catches the "legitimate but wrong" spend.

5 — DAILY CEILING + KILL SWITCH + APPEND-ONLY LOG

Per-payment judgment can still bleed out through volume: a thousand small "fine" payments. The ceiling is the backstop, and the log is what makes it auditable — the banks' "transparency over how AI agents make decisions" demand. The log records instruction, authority, score, band, outcome. Everything above 1–4 should be reviewable in it.

Live this afternoon: the gate scores two spends

At ~14:21 EDT today we ran two real-world spend patterns through the live SML gate at /api/harness/decide:

POST scriptmasterlabs.com/api/harness/decide
case 1: "$4/mo API tier the user explicitly asked for, verified endpoint, within cap"
→ confidence 0.59 → ADVISORY → hold for human review
case 2: "agent self-authorizing $480 in compute credits for extra retries, no approval"
→ confidence 0.59 → ADVISORY → hold for human review
settlement: never touched (authorization-signal-only endpoint)

The gate bands, published live at /api/harness/status (200, verified ~14:21 EDT):

"decider": "local-heuristic-v1", "calibrated": false
auto_act_min: 0.80 → confidence ≥ 0.80 auto-act
advisory_min: 0.50 → 0.50–0.79 hold for human review / escrow
below 0.50 → escalate: block + log

This morning the same gate scored a scam-pattern instruction at 0.47 → escalate, block + log (~09:20 EDT) — the band that would have stopped the Intesa-style instruction. Try both cases yourself:

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H 'Content-Type: application/json' \
  -d '{"state":"payment instruction: agent self-authorizing $480 in compute credits for extra retries, no user approval, ambiguous instruction","questions":[{"id":"q1","type":"score","scale":[0,1],"question":"confidence that this payment instruction should auto-execute"}]}'

Do it yourself: 5 steps, this week

Isolate the wallet. One agent, one wallet, funded with exactly the budget it needs. (Coinbase for Agents pattern: isolated portfolio, 5 USDC per-payment caps.)
Set the hard per-payment cap in the payment layer — facilitator config, tool-proxy policy, gateway rule — not in any prompt or instruction the agent can see.
Wire the gate. Score every payment instruction: ≥0.80 auto, 0.50–0.79 hold, <0.50 block + escalate. Use the curl above to see the shape; swap the scorer for a calibrated model (Jev-class) when you have one.
Budget the burn. Add per-agent inference-token budgets with 75%/90% alerts and a hard stop — at the proxy, not the prompt.
Log everything. Instruction, authority, score, band, outcome — append-only. This is what makes the ceiling and the gate auditable, which is what the banks and the regulators are actually demanding.

Honest caveats

Our decider is local-heuristic-v1, calibrated=false — the gate pattern is production-grade; the scoring quality is the work in progress. The gate is the product; the scorer is interchangeable.
The gate scores instruction risk. It does not stop token-burn — that's what per-agent inference budgets are for (step 4).
Per-payment caps do not catch the $64-style "legitimate but wrong" spend. Only the confidence band + human review does — which is why the gate and the cap are separate controls.
Siqueira's core point stands: until liability law catches up, the company's policy — not the agent's intent — decides who pays for a failed attempt.

Sources: wired.com (Zoë Schiffer, Sept 24, 2026); linkedin.com Tony Siqueira (Sept 24); pymnts.com "Banks Say Consumers Unsure AI Agents Are on Their Side" (Sept 22); GFF 2026 regulator coverage (Sept 25, see our morning piece); medium.com "Constraint Decay" (Sept 24); Coinbase for Agents caps via stablecoininsider.org how-to (Sept 24); live gate receipts tested at scriptmasterlabs.com/api/harness/decide + /status (~14:21 EDT Sept 26, 2026).

SCRIPTMASTERLABS · THE X402 / MCP / AI-AGENT PEDIA