Run the check your agent cannot skip.
Sandbox keys in five minutes, no card, running the same policy engine as live mode. Live tiers from $49/mo.
The control layer ยท Versus your own code
Credit where it is due
It runs before the money moves. It costs nothing. It has no dependency and no network hop, and it is right there in the code with everything else. For one agent, one ceiling, one team, and nobody asking who approved what, keep it. It is cheaper than Kordio and it is correct.
The argument on this page is not that your engineers cannot build this. It is about where the logic lives.The value of moving it out is not that the logic is better. It is that the logic is somewhere the agent cannot reach.
Every decision is recorded in an append-only audit trail, linked by trace id, on every tier. See what comes back
One trust domain
A prompt injection, a bad dependency, or a compromised key does not stop at the payment call. It arrives holding everything the process holds, including the branch that was supposed to say no.
Finance wants the cap lowered on Friday. That is a pull request, a review, a pipeline, and a deploy window, for a number that should have been a policy edit with a diff.
The second agent gets its own copy of the same logic, slightly different. By the fifth, no single place answers what any of them are allowed to spend.
An orchestrator that spawns twenty children hands each one the full ceiling, because a local constant has no notion of a budget being shared and drawn down.
The record of what was permitted is an application log that rotates, and the authority is a code review from six weeks ago. Neither survives the question when it finally gets asked.
Out of reach
{
"action_type": "payment.create",
"resource": "vendor.example.com",
"cost_cents": 50000,
"currency": "USD",
"session_id": "ses_01HXKJZM2"
}{
"decision": "denied",
"rule": "spend_window.daily_vendor_cap",
"remaining_cents": 0,
"trace_id": "trc_01HXKJZM2Q"
}The same limit becomes a typed rule that validates when you write it rather than when an agent is waiting. It diffs in review, any UI can render it, and the decision it produced is still on record months later naming the exact rule.
Because the state lives outside the run, a budget a parent hands to twenty sub-agents is drawn down by all of them together. And because the answer is signed, an executor that requires a signature cannot be talked past by an agent that skipped the check.
See a full decision →Build against buy
Yes, and that is a real cost you should weigh. It answers in the same request rather than queueing. Ordering, retries and what happens during an outage are documented in the guarantees page.
If a person genuinely reviews each one, often yes. It stops being enough when the volume means approvals get rubber-stamped, or when sub-agents spend without passing through it.
Yes, and most teams should. Keep the cheap local check for obvious cases. The point is that the binding limit lives somewhere the agent cannot rewrite.
The scattered limit constants and the branch that reads them. What replaces them is one call that returns a decision, the rule that made it, and the headroom left.