How to Give an AI Agent a Virtual Card With a Spend Limit

Agents that book travel, buy ads, or pay vendors need a payment credential. Handing them a shared corporate card number is how runaway spend and cross-tenant leaks happen. The pattern below issues a virtual card per tenant user, capped in the Account Kit and enforced on every authorization.

For budget caps beyond cards, see how to set a budget cap on an AI agent.

Step 1 — Enable cards on the Account Kit with a ceiling

await naive.accountKits.update(kitId, {
  primitives_config: {
    cards: {
      enabled: true,
      spending_limit_cents: 7500, // $75.00
      requiresApproval: true,     // agent issue/charge gates (default for cards)
    },
  },
});

Step 2 — Create the tenant user and assign the kit

const user = await naive.users.create({
  email: "customer@acme.com",
  account_kit_id: kitId,
});
const client = naive.forUser(user.id);

Step 3 — Issue a virtual card (approval-gated for agents)

import { isPendingApproval } from "@usenaive-sdk/server";
 
const result = await client.cards.create({
  name: "Q3 ad spend",
  provider: "prepaid_gift", // default: prepaid Visa, $150 max, no cardholder
  spending_limit_cents: 5000, // $50.00 cap on this card
});
 
if (isPendingApproval(result)) {
  // Surface in your UI — see how-to-add-human-approval
}

Prepaid gift cards support a published $150 maximum (per published docs). Fund narrowly for the task at hand.

Step 4 — Fund the card

Use the returned checkout_url or top-up to load exactly what the task needs — a $30 campaign gets $30 on the card, not a $500 float.

Step 5 — Let the agent charge through governed tools

Pass client.agentTools() or an MCP session into your agent loop. When the model calls the card charge tool, the gateway checks kit policy, remaining balance, and approval rules before authorizing.

Where to go next

• Build an agentic travel desk — cards + approvals in a real tutorial
• Event booking cards — per-event deposits
• Subscription spend cards — recurring SaaS per tenant
• Spend caps, approvals, and revocation — cluster explainer
• Cards docs — full lifecycle