Spending limits for AI agents: soft, hard and signed
Card networks, payment platforms and fintechs have all announced ways to let an AI agent pay within a budget. Send a payment through all four places a limit can live, and see which one actually stops it.
Follow a paymentIf an AI agent buys something on behalf of your customer, someone will ask what stops it from spending more than it should. Mastercard, Visa, Amex, Google, OpenAI with Stripe, Coinbase, Ramp and Mercury have all published an answer, and every one of them lets you set some kind of budget.
What differs is where that budget lives, and that place might matter more than the size of the limit itself, because a limit inside the agent can be talked out of it, while a limit on the card network can't.
Follow one payment from the agent to the merchant.
Scroll through the five steps. The pipeline lights up the place where the limit sits at each step, from soft to hard, with the record of intent running alongside.
Source: the companies' own documentation and announcements, April to October 2026.
Every agent payment needs an answer to one question
What stops the agent from spending more than it should? Over the past year, almost every large name in payments has published an answer, and they all let you set a budget.
The difference is where that budget is checked, which is what the next four steps follow.
In the agent's own instructions
You tell the agent not to spend more than a certain amount. That works most of the time, but it's also the easiest place to break, because the agent reads everything it comes across, including text someone wrote to change its mind.
In the platform or wallet the agent runs in
The platform can refuse a payment above a cap before it leaves your system. Coinbase's Agentic Wallet has a maximum per call and per session that only the owner can set, and Stripe's Shared Payment Tokens carry a maximum amount and an expiry.
On the card or token itself
The limit is attached to the credential and checked by the card network or the issuer. Mastercard's Token Spend Controls, live since 5 August 2026, evaluate every tokenized transaction and decline the ones that break the rules, so the agent never gets a say.
A record of what the customer asked for
This one works a bit differently, because it doesn't limit how much the agent spends so much as what it buys. Amex's Intent Intelligence Framework and Google's AP2 keep a signed record of the customer's request and check the purchase against it.
Only a payment that passes every active check reaches the merchant.
Now try it on your own agent.
Your customer gave the agent one job. Pick what the agent tries to buy, switch the four places on or off, and read the receipt to see which one stops it, if any.
Simulated, illustrative only. The hotel, the prices and the agent's behaviour are invented for this example. Each place is modelled on the article: the instructions hold unless the agent is talked out of them; the platform cap and the card limit refuse anything above $500 and can't be changed by the agent; the record of intent refuses anything that doesn't match the city, the dates or the budget.
The card can say no before the agent gets a say.
Mastercard's Token Spend Controls let the bank that issued the card set rules on the tokens used by Mastercard Agent Pay, after the cardholder has authenticated: a maximum per transaction, a daily, weekly and monthly limit, a lifetime cap, a single-use setting, and lists of allowed or blocked merchants, merchant categories and countries.
Visa describes something similar for Intelligent Commerce, which is still being deployed, and Ramp's agent cards are a concrete example of it: a single-use Visa token, locked to one merchant and capped per transaction.
Set the rules, then replay the agent's payments
Simulated, illustrative only. The five payments are invented; the rule types are the ones listed in Mastercard's July 2026 release notes.
The right amount can still buy the wrong thing.
On 13 October, American Express presented its Intent Intelligence Framework. The customer's instructions and constraints, such as the merchant, a maximum budget and product preferences, are recorded and approved first, and the agent then gets a payment credential at checkout without ever seeing the card number.
Amex's own example is a customer who asks for white Nike sneakers in size 9, where the agent tries to buy Adidas instead. A cap on the amount lets that through. A check against the intent can block it. Amex hasn't said when or for whom this will be available.
The request: white Nike sneakers, size 9, up to $150
Amount cap only
Check against the intent
Simulated, illustrative only. The brands and size come from Amex's example as reported by TechCrunch on 13 October 2026; the prices and the budget are invented.
The size of the limit matters less than who can change it.
When you put all of these systems side by side, the difference that stands out most is who gets to set the limit, and whether the agent can change it afterwards. Mercury's design separates the two most clearly: an agent can use the card assigned to it, but it can't create an agent card, change its limit or unfreeze it.
With OpenAI's Delegated Payment Spec and Stripe's Shared Payment Tokens, it's the agent's platform that sets the maximum, usually at the total of the checkout, which is reasonable for a single purchase but means the customer's own budget has to be enforced somewhere else.
Can the agent change its own limit?
As described in each company's own documentation and announcements, as of 20 October 2026. "Not stated" means the documentation doesn't say.
A cap puts a ceiling on the damage, but it can't judge the purchase.
In a paper published this year, two researchers built a shopping agent on Google's AP2 and showed that simple prompts hidden in what the agent reads could reliably change its behaviour, for example by pushing a certain brand to the top of its results.
The network limits still hold in that situation, but the agent's judgment doesn't. An agent that buys the wrong room within its budget has stayed within every rule, and a card limit won't notice. Only a record that says what the customer wanted gives you something to check against.
Three Lisbon hotels the agent can read
Simulated, illustrative only. The hotels, ratings and prices are invented; the mechanism follows Debi and Zhu (arXiv 2601.22569), where hidden prompts manipulated an AP2-based agent's product ranking.
The question sheet for your payment partner.
Tell the sheet what your agent buys and whose money it spends. It puts the seven questions from the article in the order that matters for your case, with what a good answer sounds like next to each one.
A starting point for a conversation, not legal or financial advice. Check what each partner offers in your country before you build on it.
Questions for your payment partner
A spending limit is only as strong as the place it lives.
So ask any payment partner who sets it, who can change it and how fast you can stop it. This page is for information and education only and is not financial, legal or investment advice.
Every fact on this page, and where it came from.
The descriptions of each system come from the article and the public documentation and announcements below, as of 20 October 2026. The checkout lane, the rule builder, the sneaker check and the hotel results are simulations with invented prices, illustrative only. Hello Purple is published by Purple Technology; no Purple product is described on this page.