- ›Spend caps, approvals, and revoke are the three controls that keep an autonomous agent from becoming an autonomous liability.
- ›
They must be enforced at execution time— in the gateway — not suggested in a system prompt. - ›Naïve's governance gateway checks budget, gates sensitive actions on approval, and denies all calls after revoke.
- ›Hard budget caps reserve atomically; soft caps route to approval; revoke is absolute on the agent profile.
- ›Cards, domains, formation, verification, and new app connections default to requiring approval for agent calls.
- ›
Combined with per-user cards and immutable logs, this is enforced autonomous company infrastructure— not a dashboard toggle.
An AI agent that can spend money needs three controls: a ceiling (spend caps), a pause button (human approval), and an off switch (revoke). Prompting "be careful with money" is not any of these. Naïve enforces all three through the governance gateway — the policy proxy at the tool-call boundary — so caps, approvals, and revoke apply across the whole governed agent profile, not just on cards.
This is autonomous company infrastructure at the layer buyers care about: money and risk.
Why are spend caps not optional?
Agents don't negotiate budgets. They attempt actions until something stops them — your card processor, an empty account, or an angry customer. A spend cap is the something that stops them before the damage.
On Naïve, each agent profile carries a combined budget: real-world spend (cards, trading) and platform credits (LLM, search, compute, hosted runtime) sum against one ceiling. Hard caps reserve atomically before execution — no concurrency race — and return 403 budget_exceeded when exhausted. Soft caps route to the approvals queue instead of failing silently.
Card limits are configured in the Account Kit: spending limits in cents, card type (prepaid vs managed). Prepaid gift cards support a published $150 maximum (per published docs); managed virtual cards require a cardholder and support higher limits. See introducing cards for the primitive.
How does approval work at the gateway?
Sensitive actions don't fail — they freeze. When an agent triggers a gated primitive, the API returns:
{
"status": "pending_approval",
"approval_id": "65589c8b-e033-4a65-b16c-379211c94429",
"action_type": "cards.create",
"title": "Issue virtual card \"Ads\""
}Nothing executes until a human approves. On approval, the API replays the frozen call and records the result. Deny and the action never runs.
Gated by default (for agent calls): issue a card, create a cardholder, top up a card, purchase a domain, start verification, form or file a company, connect or sign up for a third-party service (per published docs). Developers override per primitive in the Account Kit. Human callers from the dashboard or a session bypass the gate — only agent (API-key/MCP) calls are gated.
The step-by-step wiring is in how to add human approval to an AI agent.
What gets audited?
Every gateway decision — allowed, pending, denied, revoked — feeds the per-user audit log. You don't bolt on tracing to govern; governance requires recording what happened, so the stream is native and OpenTelemetry-shaped. Introducing governance covers the /logs primitive.
When a regulator, customer, or your own incident review asks "why did this agent charge $500?", the answer is in the log chain: attempted action → policy check → approval (if any) → execution result.
How does revoke differ from a cap?
A cap limits how much; revoke limits whether. agentProfile.revoke() suspends the profile — the governance gateway denies all further tool calls, releases its runtime slot, and cascades to sub-agents. Revoke is absolute and applies mid-action.
This is the control you reach for when:
- A customer offboards and their agent must stop immediately.
- Prompt injection is suspected and you can't trust the next tool call.
- A runaway loop is burning budget faster than caps can catch.
How to revoke an AI agent's access instantly covers SDK, REST, CLI, and MCP surfaces.
How the three controls work together
| Control | Stops what | When it fires |
|---|---|---|
| Spend cap | Excessive volume | Before execution (hard) or routes to approval (soft) |
| Approval | High-stakes actions | At execution — freezes until human decides |
| Revoke | Everything | Immediately — all subsequent calls denied |
The gateway applies them in order on every call: Is the profile revoked? → Is there budget? → Does policy allow this primitive? → Does this action require approval? → Execute and log.
Where this fits in your product
If you're building agents into a multi-tenant SaaS, spend/approval/revoke are the controls your enterprise buyers will ask about first. Wire them before you widen the Account Kit — one gated card issue with approval is worth more than ten autonomous primitives with no audit trail.
Cards use-case guides
The same controls show up in production tutorials: corporate travel, event bookings, and subscription spend.
The architecture reference is the governance gateway docs. The approvals guide is the operational source of truth for gating and replay.
How do you put spend caps on an AI agent?+
What is human-in-the-loop approval for AI agents?+
How do you revoke an AI agent's access?+
What is the governance gateway?+
Why can't I rely on prompt instructions for spend control?+
Which actions require approval by default?+
Building the agent-native backend.
How to set a budget cap on an AI agent: combine agent-profile budget with Account Kit card limits so spend is enforced server-side, not in the prompt.
Give an AI agent a virtual card with a spend limit: issue per tenant user, cap in the Account Kit, and enforce every charge at the gateway.
A governed agent profile is an AI agent with identity, spend limits, approvals, audit, and instant revoke — enforced on every action. Here's the full lifecycle.
How to add human approval to an AI agent: gate sensitive actions on your Account Kit, surface pending approvals, and replay on approve. A step-by-step guide.