How do I let an AI agent spend money safely, with limits and a person approving purchases?

Issue it its own virtual card. Stripe Issuing and Lithic let your code set limits per transaction or per period and restrict merchant categories, and Privacy.com’s Plus plan ($5 a month) gives a solo developer an API for single-use and merchant-locked cards. Give each agent its own card, so one agent’s mistake can’t spend another’s budget.

Not inside the card authorization: Stripe gives your authorization webhook 2 seconds by default and Lithic gives it 6, enough for code but not for a person. Get the yes before the payment instead: Link Agent Wallet asks the person to approve each spend request (they have 30 minutes), LangGraph’s interrupt() pauses your own agent until someone resumes it, and NoClick holds an agent’s purchases until the account owner approves them from a link.

For model spend alone, give each customer a budget in LiteLLM or their own OpenRouter key with a credit limit. On NoClick, create the agent inside the user’s scope with budget_usd_per_month and give the user spend_cap_usd_per_month; a usage.recorded webhook reports each charge so your billing can charge them or pause their spending. For cards, Stripe Issuing for platforms issues cards to your customers, through a conversation with Stripe.

Put a hard cap where the calls go out: OpenAI’s project hard spend limits reject requests with a 429 once reached, and LiteLLM, Portkey and OpenRouter cap a key. Also cap each run: a NoClick agent’s turn stops at $1, 30 minutes or 200 steps by default, and a call repeated with the same arguments and result stops running.

Most limits are checked as a charge starts and totals catch up later: Stripe says spend totals can lag up to 30 seconds, Lithic’s velocity totals are eventually consistent, and OpenAI may process some extra usage while a limit updates. NoClick checks caps before work starts, so the call that crosses a cap finishes and the next is refused; leave that margin when you set one.

With card and gateway APIs, whoever holds the secret key can change a limit, so keep that key out of the agent’s reach. On NoClick, an agent connected through MCP, the NoClick assistant included, can only lower a cap or set one where there’s none; raising or removing one waits for the account owner to approve it from a link NoClick sends them.

On NoClick the agent quotes the domain or number, then buys it under a ceiling (max_price_usd for a domain, max_monthly_usd for a number), and a purchase made with NoClick’s agent tools waits until the account owner approves it from a link showing the exact price. Buying either needs $5 of funds added, and the charge counts toward your caps like any other spend. Elsewhere, put the registrar’s or carrier’s purchase call behind your own approval step, such as a LangGraph interrupt.

Open now: Privacy.com, Crossmint (free to start) and the x402 protocol, which is open source with no protocol fees but has no spending limits or approvals of its own. Gated: Stripe Issuing and Lithic need an application or a sales conversation, Link Agent Wallet’s payments are for US and Canadian customers with Shared Payment Tokens in preview, Ramp’s Agent Cards are in early access, and Visa Intelligent Commerce needs Visa’s onboarding and approval for production.