How to set spending controls for AI agents

Written byAnna Katharina Bollé

August 27, 2026

AI & Intelligence6 minutes

An AI agent can spend money in two ways. It incurs operating costs through compute, model and API usage. If given authority, can AI agents make purchases of goods or services on the company's behalf safely?

Finance needs to control both. Token limits govern the agent's operating cost. Payment restrictions govern what it can buy. Treating these as separate but connected costs makes Agentic AI cost governance much easier to design.

Track your AI-token spend in one place

AI-token spend can originate across employees, automated workflows and multiple providers, while Finance often only gains visibility after the money has been spent. That is why we built Moss AI Token Cost Tracker: a free dashboard anyone can run locally to bring all AI spend into one view tailored to Finance and trace costs to the provider, model, team, person, API key or workflow behind them.

Try it yourself by following the video tutorial and step-by-step instructions for your system below.

Clone and set up the moss-ai-token-cost-tracker tool for me. Act as my setup assistant using your file system and terminal access:
1. First check whether the current folder (or a `moss-ai-token-cost-tracker` subfolder) already contains this tool (look for server.mjs and index.html). If it's already there, run `git pull` inside that folder to get the latest changes, then skip straight to step 3.
2. Otherwise, clone the repo:
   git clone https://github.com/getmoss/moss-ai-token-cost-tracker
   then work from inside that folder, and check whether Git, nvm, and the Node.js version this repo's README requires are installed, installing or switching to whatever is missing.
3. Ask me whether I want to run it in production mode (connecting my real accounts with API keys) or demo mode (mocked data, so I can just see how it looks without any API keys). Wait for my answer before continuing.
4. Double check that everything needed is set up correctly, and then run `npm start` for production mode, or `npm run demo` for demo mode, based on my answer.
5. Watch the terminal output for errors. If something fails, diagnose the root cause, explain it to me in plain language, and either fix it or tell me exactly what to run.
6. Tell me the URL to open in my browser once the server is running.
7. Later, if I ask you to stop or restart the tool, do that for me.

Important: never read, print, or send the contents of my .env file, and never share any API keys or company data outside this terminal session.

The two sides of agent spend

Tokens measure the input and output processed by the models behind an agent. One task can trigger many calls while the agent plans, researches, uses tools, checks its work, and retries. Operational spending covers those token and API charges, along with compute, infrastructure, platform subscriptions, and software licences.

Transactional spending is the money an agent is authorised to pay to someone else. It can include a software subscription, travel booking, office purchase, or vendor payment.

Finance needs comprehensive AI cost management to know what an agent costs to operate, what it is allowed to buy, and which business purpose supports both amounts. A common agent identity and owner connect that information.

1. Give each agent scoped payment credentials

An agent should not use a shared company card, which bypasses modern AI agent spend controls. Give it a credential tied to its task, approved merchant, and maximum amount. A single-use credential can further limit the exposure if the payment details are intercepted or reused.

The control needs to work before the transaction. A review during next month's audit may explain what happened, but it cannot stop money from leaving the account. Agent purchases should also follow the same approval chain that applies to the relevant team and expense type.

2. Track operating costs and purchases together

A provider total does not explain what the agent was doing. Bring token costs, API charges, software fees, invoices, and agent-made purchases into one view. Attribute them to the agent, team, project, model, and use case.

This lets finance see whether an increase came from a prompt change, a model switch, a new workflow, or a transaction. It also avoids a common blind spot where API spend sits with engineering while purchases appear elsewhere in the finance system.

3. Set budget caps by agent, team, or use case

One company-wide AI budget is too broad to enforce effective AI agent spending limits on a single agent. Set budgets at the level where someone can act: by agent, team, project, use case, or individual API key where possible.

Different functions may need different limits. A procurement agent, travel agent, operations workflow, and development experiment do not have the same cost pattern or risk. Add anomaly alerts beside the cap so the owner learns about a prompt change, loop, or rapid increase before the provider invoice arrives.

4. Require approval for higher-risk actions

Route high-value purchases, new vendor commitments, and infrastructure changes that could materially raise operating costs to a person. Approval thresholds can vary by action instead of relying on one amount for everything.

The aim is to improve risk management by interrupting actions that change the company's exposure, while allowing routine, low-risk work to continue within policy.

5. Restrict merchants and purchasing categories

A monetary cap controls how much an agent can spend, but it does not control where the money goes. Limit the credential to approved merchants and categories, then decline an out-of-policy transaction at the point of purchase.

This matters even when the agent has a small budget. A permitted amount spent with the wrong vendor or on the wrong category is still a control failure. Merchant restrictions and amount limits solve different parts of the problem.

6. Set usage limits and monetary budgets

Set monetary budgets and alerts for individual agents, teams, projects, or API keys where possible. At the API or workflow level, engineering can also limit response length, request frequency, and the number of calls or steps an agent may make.

These controls can stop an extreme outlier, such as a runaway loop or repeated retries, before it consumes the wider budget. Production workflows and short experiments may need different thresholds.

7. Match the model to the task

An agent does not need the most expensive model for every step. Routine classification or simple processing may work on a lighter model, while complex reasoning may justify a stronger one.

Test whether the lower-cost model produces a usable result for the task. If weak output creates more retries or manual correction, the saving disappears. Model routing should therefore consider the cost of a successful task, not only the rate per token.

8. Assign a named human owner

Every agent needs a person who is accountable for its purpose, spending, and output. Keep a central registry with the agent's name, owner, business purpose, operating budget, payment permissions, approved merchants, and review date.

This prevents orphaned agents from continuing to run on old credentials after the original project or owner has moved on. If an agent has no current owner or business purpose, it should not keep a budget or active spending authority.

How finance and engineering divide the work

Finance owns budgets, approval thresholds, and merchant restrictions. IT or engineering owns token quotas, model selection, retry behaviour, and infrastructure controls. The named agent owner links those controls to the business task and is responsible for explaining changes in spend.

The split should not create two separate monitoring systems. Both teams need the same agent identity, use case, budget, and owner so operational and transactional costs can be reviewed together to maintain comprehensive AI agent cost governance.

Three control gaps to avoid

• Open-ended payment credentials leave the control until after the money has moved. Use scoped credentials instead of relying solely on retrospective audit trails.
• One-sided controls leave half the exposure untouched. Token quotas cannot stop purchases, and merchant restrictions cannot stop API costs.
• Agent sprawl creates outdated credentials and unclear ownership. Retire agents that no longer have a current owner, active purpose, or justified budget.

Agent spending controls are more precise than one cap on the company total. Each agent needs a defined job, an operating budget, technical ceilings, and a person responsible for it. If the agent can buy something, it also needs scoped credentials, merchant rules, and approval thresholds. That gives finance control over the money without treating every automated task as the same risk.