How to let an AI agent make payments

The obvious shortcuts all hand the model something it can misuse. A private key or a card number in the prompt means every instruction the agent reads, including ones hidden in a web page or a tool result, is one step from spending. Limits written into the system prompt are requests, not controls: the model can be talked out of them or simply get them wrong. And approving every payment by hand works but defeats the point of an agent. The workable middle is a separate service that holds the policy and the money path, and exposes only a narrow tool to the model.

1. Decide what the agent is paying for. Write down the recipients and typical amounts: API credits, a dataset, hosting, another agent's work. This decides your limits and whether you can use a recipient allowlist, which is the single strongest control.
2. Keep the money behind a tool. Expose a tool such as create_payment over MCP or your agent framework's tool interface. The tool takes amount, asset, recipient and a reason. It never returns a key, card number or seed phrase, and the model never sees one.
3. Enforce limits on the server. Set a per-payment cap and a daily cap, then two bands inside them: below an auto-approve limit the payment can go through on its own, between that and an ask limit a person approves it, above it the payment is refused. Check these where the model cannot reach them.
4. Put a person on the larger amounts. Send approvals somewhere you will see them (email, a push notification) and let them expire if nobody acts. The person should confirm the amount and recipient, not just a description the agent wrote.
5. Make retries safe. Require an idempotency key on every payment so a retried call does not pay twice, and teach the agent to check a payment's status before trying again.
6. Test on a simulated rail first. Wire everything up against a source that moves no money, watch which payments are approved, held and blocked, then switch to real funds with the same limits.

• It does not mean giving the agent your wallet's private key or seed phrase. Anything the model can read, a prompt injection can try to use.
• A spending limit in the system prompt is not a spending limit. It has to be enforced by code the model cannot edit.
• Letting an agent pay does not mean letting it pay anyone. Restricting recipients matters as much as restricting amounts.

• MCP specification: Tools (human in the loop, security considerations)
• OWASP GenAI Security Project: LLM01 Prompt Injection
• Veyra docs

• MCP serverAn MCP server is a service that offers tools, resources or prompts to AI applications using the Model Context Protocol, an open protocol built on JSON-RPC 2.0.
• Auto-approve limitAn auto-approve limit is the largest single payment an agent may make without a person approving it, within any other caps that apply.
• Idempotency keyAn idempotency key is a unique value a client attaches to a request so that, if the same request is sent again with the same key, the server returns the original result instead of performing the action a second time.

• How to set spending limits for an AI agentPer-payment cap, daily cap, an auto-approve band and an ask band, enforced outside the model. How to choose each number and what happens at each edge.
• Human-in-the-loop approval for AI agent purchasesHow to make an agent wait for a person before larger payments: where the request goes, what the approver checks, and what happens if nobody answers.
• Should you give an AI agent a crypto private key?Why a private key in an agent's prompt, config or environment is full control of the wallet, and what to do instead to let it pay without one.
• How to test AI agent payments without real moneyRun an agent's payment flow end to end on a simulated rail: what to test, how to tell simulated from real, and what a testnet does and doesn't prove.

All guides →