AI agent spending limits: Setting terms for funded accounts

Funding AI agents is one thing. Giving them access to funds is another. When developers talk about setting "spending limits" in agentic commerce, they could be talking about one of these two layers.

First, there are operational costs. From token consumption to tool calls, developers have to set the payment thresholds to keep their agents running. Second, AI agent spending limits also refer to restrictions on autonomous machine payments. Each area needs different enforcement mechanisms to keep cash flow under control. Token budgets and execution limits help manage operational expenses, but developers need more infrastructure-level payment policies when handing agents cash.

However, funding an agent's account doesn't mean relinquishing authority. Well-defined AI agent spending limits set how much an agent can spend and under what conditions. With the proper controls in place, funded agentic accounts have useful autonomy without unlimited access.

Below, we'll dive into the specifics of AI spending limits on funded accounts and how developers restrain an agent's behavior.

What do AI agent spending limits control?

AI agent spending limits determine what an agent can pay through a delegated credential or authorized payment path.

However, just because an agent has access to a funded account doesn't mean it can spend the entire balance. These limits also don't restrict the account's root keys or other independently authorized keys, and they don't cover operational costs billed outside the agent's delegated credential. Spending limits solely apply to the agent's delegated payment authority.

There are three dimensions that developers could introduce as restrictions on an agent's spending power:

• AmountThis defines how much the agent can spend, either per transaction or as a larger allowance for a complete session.
• Time or spending periodAlongside value, developers can choose agents' spending periods by setting expirations.
• Permitted recipientsTo avoid spending with unapproved parties, developers can add restrictions for certain merchants or vendors.

Together, these boundaries let the agent act autonomously, without unrestricted access to funds. The account's owner maintains complete control, and if necessary, administrators can step in to update conditions or revoke an agent's access.

How do funded accounts and delegated payment authority work? 3 layers

AI payment infrastructure clearly separates where funds are from who can spend them.

An account or wallet holds the funds, and agents can only use them through delegated credentials. Remember that the agent doesn't own the money itself; it only receives permission to initiate payments through predefined limits.

The typical agentic payment flow involves three layers:

1. Hold: Funds sit in an account

The first step is making funds available in an account that supports agentic payments. Agents can't access the entire value of this account without applicable permissions. Administrators still control the funds.

2. Receive: Adding additional funds

Account owners have the power to add more funds when necessary. Even as agents carry out tasks, there's no need to worry that extra funds will change their behavior. Agents still have to stay within their spend controls.

3. Pay: Agent exercises delegated authority

Once an agent has authorized payment credentials, it has the authority to initiate permitted transactions. The credential defines the agent's scope of authority. Even though an agent doesn't need human signatures to complete a purchase, these payments can't fall outside of its permissions.

One account can authorize multiple agents

For convenience, it's possible to link many independent access keys to just one funded account. Account owners don't have to create separate balances for each agent, application, or deployment. Instead, they can issue different credentials from the same account with distinct restrictions.

Each access key has its own spending limits and permissions. If administrators notice an agent is compromised, or they simply don't need it anymore, they can revoke its access key. An expiry set when the key is authorized also ends its access on schedule. It's also possible to update permissions whenever an agent needs a slightly different set of responsibilities. The account owner always has authority over their funds.

How developers enforce AI agent spending limits

Prompting isn't enough to prevent agentic overspend. Instructions like "Stay within a $500 budget" may seem clear enough to a human, but there's no guarantee an agent won't misinterpret a prompt or make an unexpected transaction.

Infrastructure-level controls limit an AI agent's payments in ways a prompt can't. They include:

• Amount caps or spending budgetsPrevent individual payments from overshooting thresholds through per-transaction caps. Aggregate budgets can also limit an agent's total spend.
• Fixed time periods or expiryCreate temporary permissions or recurring spending windows by defining how long an agent's authority lasts.
• Recipient restrictionsScope an agent's spending to specific vendors and wallets with allowlists and blocklists.
• Token transfer and approval selectorsFurther limit where an agent spends by tying specific token transfer types to different recipients.
• Contract or function scopeDefine approved smart contract programs or other onchain functions for agent interactions if they're supported.
• Revocation of delegated authorityThe account owner has the option to withdraw an agent's permissions without affecting the funded account.

What happens when a transaction exceeds an agent's limit?

Payment attempts that overstep an agent's credentials won't work. That's the purpose of all these infrastructure-level spending boundaries.

Putting protections in place at a coding level makes an agent's payment execution predictable. In order for a transaction to go through, you'd need to take action like manually increasing the spending limit or authorizing another payment method.

Remember that recipient restrictions don't always work for agentic transactions, and these limits only apply to specific blockchain operations. The access key can't inspect every possible smart contract interaction and identify the recipient involved.

In more complex contract calls, transaction instructions or recipient addresses may fall outside the supported restrictions. Similarly, these controls don't automatically apply to offchain payments. With this in mind, developers have to be extra careful about the token operations and approval functions in their payment infrastructure. Never assume recipient address restrictions cover every way an agent can move funds.

Fund agents and control spending with Tempo and MPP

On Tempo, developers keep their funding separate from their agent's scoped authority. The Tempo account holds the stablecoin balance, and holding that balance gives an agent no spending authority.

Permissions come from Tempo access keys, where developers set restrictions like spending limits, expiry, and recipient restrictions. Once they're configured, agents initiate their payments through the Machine Payments Protocol (MPP). Co-authored by Tempo and Stripe, MPP offers a machine-native environment, where agents directly negotiate for services through an HTTP 402 payment flow.

We also offer prepaid MPP Credits for select agentic purchases. MPP Credits are issued by Coinflow, a licensed payment service provider. Developers can buy these credits through a Tempo Wallet with a supported credit or debit card. Agents use them to pay for eligible Tempo-proxied one-time MPP services, and merchants receive the stablecoin USDC.e via Tempo. Note that MPP Credits are nonrefundable and can't be withdrawn or converted to fiat or other tokens.

Explore how Tempo wallets, access keys, and MPP can organize your agentic payment flows.

FAQ

What happens when an AI agent reaches its spending limit?

An AI agent should never execute payments outside of its authorized spending capacity. Unless there's a limit reset or an authorized party changes these specifications, an AI agent can only complete non-spending-related tasks after exceeding its limit. Exactly how this plays out in the real world depends on the agent's unique configuration.

How should developers set an AI agent's spending limit?

When setting a spending limit, developers should consider the agent's intended workflow, average transaction size, and the authority it needs to complete its tasks. Using per-transaction limits alongside daily or monthly budgets further prevents transactions from draining available funds.

When should developers change an AI agent's spending limit?

Changes to an AI's spending limit should coincide with updates to its responsibilities. Ideally, spending limits should be configurable rather than fixed so developers can make adjustments as workflows evolve.

How can an AI agent's payment authority be limited by amount, recipient, and time?

Developers have numerous tools available to them to restrict an agent's spending activity, including per-transaction caps, recipient allowlists, and expirations. Administrators also have the power to revoke or change their agent's spending authority whenever they notice an issue.

How can AI agents have separate spending limits?

An account owner can create separate access keys for different AI agents. Each of these keys could have unique spending permissions. That way, even though multiple agents use the same funding source, their distinct keys enforce different boundaries.

How do AI agents hold, receive, and pay from funded accounts while humans stay in control?

AI agents don't hold funds. Rather, it's the account that holds and receives them. Any authority that agents have to spend these funds comes from scoped credentials. Humans still retain their administrative authority.

---

Talk to the Tempo team about setting spending limits for your agents' payments on Tempo.