What are spend controls for AI agents?
· By the Shotoku team
Spend controls for AI agents are rules, enforced outside the model, that decide whether an agent may spend money before the spending happens. They limit how much an agent can spend, who it can pay and when a human must step in, and they keep a record of each decision.
Why do AI agents need spend controls?
Agents now call paid APIs, buy services and issue refunds without a person clicking anything. Normal software spends in predictable ways, but an agent chooses its actions at run time. It can loop, follow a bad instruction or misjudge a task, and it can do that many times a minute.
What are the five core controls?
| Control | What it does | What it catches |
|---|---|---|
| Per-transaction limit | Caps one payment or call | A single expensive mistake |
| Rolling budget | Caps the total over a period | Loops of small charges |
| Allowlist | Limits who can be paid | Unknown vendors and redirected payments |
| Human approval | Holds anything outside the rules | Cases the policy can't decide |
| Audit trail | Records every decision and why | Disputes and questions after the fact |
You usually need several together. A per-transaction limit can’t see a loop, and a budget can’t see a bad vendor.
Where should spend controls run?
Outside the model, and before the money moves. A limit the model is merely asked to respect is a suggestion. The check needs to run in code that sits between the agent and the payment, so the agent’s reasoning doesn’t decide whether the check happens.
The decision should also be predictable. If the same request can get different answers, you can’t test your policy or explain a result. That’s why rule-based checks fit this job better than asking a second model.
How do spend controls differ from similar tools?
| Tool | What it does | How it differs |
|---|---|---|
| Prompt instructions | Asks the model to behave | Not enforced |
| Billing alerts | Report spending | Act after the money is spent |
| Provider caps | Limit an account or project | Usually one vendor, not one agent |
| Virtual cards | Limit a card's merchant and amount | Cover card payments, not API usage or tool calls |
| AI gateways | Route and meter model traffic | Focus on model calls, often as a hosted service |
| Agent wallets | Hold keys and make payments | Move the money, so a wallet carries custody risk |
These can work together. A virtual card or an on-chain limit makes a good hard ceiling under a policy that decides each request.
What should you look for in a spend control tool?
- It fails closed. A missing policy or a bad request means no, not yes.
- The agent can’t change it. Neither the limits nor the approvals are reachable by the agent.
- State survives a restart. A restart must not reset the budget.
- It explains itself. Each decision states the rule behind it.
- It covers your real routes. Check every way your agent can spend, not only the main one.
- The log can be verified. A tamper-evident record is worth more than a plain log.
How do you get started?
- List every way your agent can spend money.
- Set a low limit per transaction and a daily cap, based on a normal day.
- Hold anything unknown for a human.
- Review the decision history after a week, then adjust.
The spending limit guide walks through this with working code.
Common questions
Are spend controls only for crypto payments?
No. They apply to any way an agent spends: API calls, card purchases, PayPal refunds or stablecoin payments. The rule stays the same, and only the connection to the payment method changes.
Do spend controls need to hold my money?
No. A decision only needs the amount, the recipient and the agent. Shotoku, for example, never holds funds or keys.
What is Shotoku?
Shotoku is open-source spend controls for AI agents: budgets, human approvals and a tamper-evident audit trail. It is deterministic, takes no custody and runs on your machine. Start with the quickstart.