Levee / AI agent spend controls
AI agent spend controls: what they are and how to set them up
A practical checklist for teams letting software spend money on their behalf.
Short answer: AI agent spend controls are the limits, approvals and checks that decide what an AI agent is allowed to buy. The ones that hold up are enforced outside the agent, at the moment the card is authorized, and leave a record of why each payment was approved or declined.
Why agents need spend controls
A person with a company card is bound by policy, training and the fact that they can be asked to explain a charge. An AI agent has none of that. It acts quickly, can repeat a mistake a hundred times, and can be steered by text it reads on a web page or in an email. Giving an agent a card with no controls means the only limit is the card's credit line.
Spend controls turn "the agent can pay" into "the agent can pay for these things, up to this amount, until this date, with a human's sign-off where it matters."
The core controls
1. Budget caps
A total limit for the task, plus per-transaction and per-day limits. Caps are the simplest control and the one every team should set first. Their weakness is that they say how much, not what for.
2. Merchant and category locks
Allow only named merchants or merchant category codes. This narrows where money can go, but categories are broad and some purchases look the same to the card network. See why card limits and MCC blocks aren't enough for AI agents.
3. Single-use and per-task cards
Issue a separate card for each job so a leak or error stays contained. This caps loss per card but not across cards, and it only helps if the agent can't create cards freely. We compare the two approaches in one-time virtual cards vs spend mandates.
4. Approval ladders
Small, expected purchases go through on their own. Larger or unusual ones pause for a person. A good ladder is defined in advance and challenges rather than silently approving or declining.
5. Time windows
Authority should expire. A mandate for a conference booking should end when the conference does, not live on until someone remembers to cancel it.
6. Evidence
Every approval and decline should be recorded with its reason and who set the rules. Without it, finance, auditors and dispute teams are left reconstructing intent from card statements.
Why controls must sit outside the agent
If the agent is the thing deciding whether it is within budget, then anything that changes the agent's behavior changes the control. That includes prompt injection, a bad tool result, or a model update. Putting the check at card authorization, in a separate system the agent can't reach, means the answer doesn't depend on the agent behaving. The card declines purchases outside what a human approved, so the damage from a confused or manipulated agent is bounded.
It also has to fail closed: if a decision can't be made in time, the payment is declined rather than waved through. The glossary explains the term.
From controls to mandates
Individual limits are useful but scattered across card settings, scripts and policies. A spend mandate brings them together: a human approves a purpose, merchants, a budget and an end date once, and every authorization is checked against it. The mandate is the unit a person approves; the controls above are how it is enforced. For the full flow, read what is AI agent spend authorization?
A starting setup
- Write down what the agent is for and the most it should spend on it.
- Set a total budget, a per-purchase limit and an end date.
- List the merchants or categories it needs; block the rest.
- Decide which purchases need a human and how they are asked.
- Use per-task or single-use cards from your issuing provider.
- Enforce the rules at authorization, outside the agent, and fail closed.
- Keep a record of each decision and review it regularly.
Where Levee fits
Levee is the authorization layer for AI agent spend. Levee lets a human approve what an agent may spend, enforces it at the moment of card authorization, outside the agent, and keeps tamper-evident proof of every decision. It is not a card issuer and never holds or moves money: cards stay with your issuing provider, such as Airwallex, and Levee works alongside the controls you already use.
Frequently asked questions
What are AI agent spend controls?
They are the rules and checks that limit what an AI agent can spend: budget caps, merchant and category locks, approval steps, single-use cards, and a record of every decision. Good controls are enforced outside the agent, at the moment a payment is authorized.
Which AI agent spend controls matter most?
Start with a hard budget cap and a merchant or category lock, add single-use or per-task cards, route unusual purchases to a human, and enforce all of it at card authorization. Keep a reasoned record so finance can review every decision.
Why can't the agent enforce its own spend limits?
An agent's instructions can be changed by bad input, mistakes or a poorly worded prompt. A limit the agent is asked to respect is a request, not a control. Enforcement has to sit where the agent can't override it, such as the card authorization step.
Do spend controls stop prompt injection?
No control stops all prompt injection. What a control can do is bound the damage: when the card declines purchases outside what a human approved, an injected agent can only spend within that approval.
Does Levee hold or move money?
No. Cards are issued by your issuing provider, such as Airwallex. Levee decides whether each agent payment should go through and keeps tamper-evident proof of the decision; it never holds or moves money.
Related
Levee is running a free design partner pilot for platforms putting AI agents in charge of spend.
Become a design partner