Levee / Learn / Limit damage from prompt-injected purchases
How to limit the damage when a prompt-injected AI agent tries to buy something
You can't make an agent immune to bad input. You can make sure bad input can't spend more than a human allowed.
Short answer: you can't reliably stop prompt injection, but you can limit what it can buy. Put the spending limit outside the agent, at card authorization, and check each purchase against what a human approved: the purpose, the merchants, a total budget and an end date. Purchases outside that mandate are declined, so a manipulated agent can only spend inside the approved box. Add per-task cards, a human step for unusual purchases, and a record of every decision.
How a purchase gets injected
Prompt injection is when text the agent reads contains instructions the agent follows as if they came from you. A web page, a PDF, an email, a product review or a tool result can all carry them. For agents that can pay, the goal of an attacker is simple: get the agent to buy something, pay someone, or hand over card details. The agent doesn't need to be "hacked" for this to work. It only needs to be persuaded.
Better prompts and filters help, but they are a probabilistic defence. If the only thing standing between injected text and your money is the agent's judgment, the control is only as strong as that judgment on its worst day.
Don't put the limit where the attacker's text can reach
Anything the agent is asked to respect can be argued with. "Stay under budget" in the system prompt is a request. A check at card authorization, in a separate system the agent cannot edit, is a control. The attacker's text can change what the agent tries to do. It can't change what the authorization step allows.
Six ways to bound the damage
1. Give the agent a mandate, not a card
A mandate states what the agent may buy, from whom, for what purpose, up to what amount and until when, approved by a person. The mandate defines the worst case before the agent starts. See what is AI agent spend authorization?
2. Lock merchants and categories
If the agent should only buy from three vendors, allow those three. An injected instruction to pay a stranger then fails. Categories are broader, so prefer named merchants; card limits and category blocks alone aren't enough.
3. Use per-task or single-use cards
A card made for one job keeps a leak or a bad purchase contained to that job. It works best when the agent can't create cards freely, as covered in one-time virtual cards vs spend mandates.
4. Cap the total and set an end date
The most a manipulated agent can spend is the budget you set. A short end date shrinks the window an attacker has.
5. Send the unusual to a person
New merchants, high amounts, new payees or a changed currency should pause for a human. A purchase an injection invents will often look unusual.
6. Fail closed and keep a record
If the system can't make a decision in time, the payment should be declined. Every approval and decline should be recorded with its reason, so you can see which attempts were stopped and review near misses. The glossary defines fail closed.
What this does not do
Spend controls don't stop the agent reading hostile text, leaking non-payment data or taking non-payment actions. They also can't tell a legitimate purchase from a harmful one that fits inside the mandate, which is why the mandate should be as narrow as the job allows. The aim is a small, known worst case for money, not perfect safety.
Where Levee fits
Levee is the authorization layer for AI agent spend. Levee lets a human approve what an agent may spend, enforces it at the moment of card authorization, outside the agent, and keeps tamper-evident proof of every decision. Purchases outside the mandate are declined. Levee is not a card issuer and never holds or moves money: cards stay with your issuing provider, such as Airwallex. For the wider checklist, read AI agent spend controls, and see how approaches compare in AI agent spend control tools compared.
Frequently asked questions
Can you stop prompt injection from making an AI agent buy something?
Not completely. No control stops all prompt injection. What you can do is bound the damage: if every purchase is checked at card authorization against what a human approved, an injected agent can only spend inside that approval, and everything outside it is declined.
Why is a prompt instruction like 'never spend over $500' not enough?
An instruction is a request the agent can be talked out of. Text the agent reads, such as a web page, an email or a tool result, can override or reshape it. A limit has to be enforced somewhere the agent cannot change.
What does bounded damage mean?
It means the worst case is known and small before anything goes wrong. With a mandate that names the purpose, merchants, a total budget and an end date, the most a manipulated agent can spend is whatever the mandate allows, not whatever the card's credit line allows.
Should an agent be able to create its own cards?
Preferably not without a check. If an agent can mint cards with any limit it likes, a manipulated agent can too. Card creation should be governed by a human-approved mandate.
Does Levee stop prompt injection?
No. Levee does not stop prompt injection itself. It declines purchases outside the human-approved mandate at card authorization, outside the agent, so the damage from a manipulated agent is bounded. Levee is not a card issuer and never holds or moves money.
Related
Levee is running a free design partner pilot for platforms putting AI agents in charge of spend.
Become a design partner