Your agent already has a credit card

Your agent already has a credit card. Not metaphorically. Not in some speculative future where payment protocols mature. Right now, in production systems you may already run, an agent can spend money through means that were never designed for autonomous software: a browser session with a stored card, an API key whose billing account is yours, a cloud console cookie that survived a handoff, a “temporary” provider account that somehow got a payment method attached.

The money moves. Then, if you’re lucky, an alert fires.

That sequence — spend first, notify later — is the default safety story of agent infrastructure in 2026. It has the wrong shape for the problem. Alerts are for anomalies you can reverse. Domains, year-long compute reservations, and production teardowns are commitments. Treating them like token burn is how teams discover, on a Tuesday morning, that an agent bought something they cannot easily undo.

We need a name for the missing layer and a vocabulary for its mechanics. The short version is this: governance for agent spend is not FinOps with a chatbot skin. It is policy before execution, budgets as reservations, approval on irreversibility, and a ledger that never lies by omission.

The spend path that already exists

Consider a concrete path that does not require science fiction.

A coding agent has access to a developer’s machine. The developer once logged into a cloud provider in that browser profile. The agent needs a domain for a demo. It opens a registrar, finds a name, and the checkout form autofills. Or it uses a provider MCP that already holds a billing relationship. Or it calls Stripe Projects, which launched with 32 providers and left day-2 governance as an exercise for the caller.

Each path follows directly from giving software the same credentials humans use to buy things. The industry spent 2025–2026 removing friction from agent provisioning through temporary accounts, auth.md-style self-provisioning, tokenized payments, and network-level agent payment rails. That work was necessary. It also made the next failure mode inevitable: agents that can acquire real internet infrastructure faster than any human can supervise the acquisition.

Gartner projected that over 40% of agentic AI projects would be canceled by the end of 2027, citing escalating costs, unclear business value, or inadequate risk controls. That forecast is usually read as a token-spend story. Token spend is real, but reversible at the margin: stop the loop. Infrastructure spend is different. A registered domain has a renewal clock. A VPS left running is a monthly invoice. A production delete is a one-way door. The tools that emerged to govern LLM API burn (reservation, anomaly detection, attribution) do not govern the irreversible layer. They alert after tokens move. The infra layer needs something that can refuse before the registrar call leaves the building.

After-the-fact is not a control plane

Most “agent safety” dashboards share a structure:

The agent acts.
Telemetry records the act.
A threshold is crossed.
A human gets a Slack message.

That is observability. Observability is good. It is not governance.

Governance asks whether the action was allowed at all: under whose authority, against what remaining budget, and with what undo path? If your answer depends on a human reading an alert in time, you do not have a control plane. You have a hope.

The after-the-fact pattern fails in three specific ways for infrastructure:

Concurrency. Two agents each see $40 of headroom under a $50 cap. Both buy. The cap was a suggestion. Naive “check balance then charge” accounting loses to parallel quotes the same way naive bank ledgers lose to double-spend without reservations.

Irreversibility. Some actions cannot be compensated cheaply. Premium domain registration, production teardown, transferring a name out — these need a human principal in the loop before the side effect, not a postmortem after.

Attribution without authority. A beautiful audit log of what went wrong does not restore the money or the zone. Receipts without a prior gate are archaeology.

FinOps for tokens taught the industry useful habits: budgets, attribution, anomaly alerts. They are necessary but insufficient for agent-bought infrastructure. The missing piece is a governor: a service that sits between the agent and the provider and makes side effects conditional on policy, budget, and (when needed) human approval.

The structural alternative

The fix is not a smarter alert. It is a different order of operations:

Policy before execution. Every mutating call hits a policy decision point first. Default deny. Forbid wins. No code path mutates provider state without a verdict. Verdicts are three-valued: allow, deny, or require approval. “Require approval” is not a 403 with a shrug; it is a structured gate the agent can watch while a human decides.

Budgets as reservations (two-phase). A quote that policy allows places a reservation for the full amount, with a short TTL. Commit converts the reservation to spent. Expiry or cancel releases it. Policy evaluates against committed + reserved, so concurrent agents cannot each look affordable. This is boring database accounting. Boring is the point. Caps that only check at commit time are theater under load.

Approval on irreversibility. The human is the principal — the person who holds the payment instrument, sets the ceiling, and decides the one-way doors. Agents may request. Agents may not resolve their own gates. If your design lets an agent approve its own spend by talking persuasively to a model-facing endpoint, you have built a loophole with an API.

Ledger always. Every mutation writes exactly one ledger entry: cost, provider references, undo information, workflow identity. Corrections are compensating entries, not edits. Silent side effects are bugs, not features. If it happened and it is not in the ledger, your control plane is lying by omission.

You can also bind spend to a human-signed mandate, a cryptographic budget ceiling (we use AP2-format payment mandates) that a third party can verify without trusting your database. Platform caps and mandates dual-enforce. Proofs verify against published keys. The mandate does not replace the ledger; it makes the ceiling independently checkable.

That sequence — policy → reserve → approve (when required) → commit → ledger — defines the category. Call it governed agent spend. Everything else is provisioning with vibes.

Vocabulary worth owning

Names matter because agents and auditors need a shared wire language, not a new label from every vendor.

Governor — the control plane between agents and providers. Owns policy, budgets, approvals, and the ledger. Not a chatbot. Not a dashboard with teeth painted on.
Envelope — the response contract that makes governance legible to machines: receipt, undo, remaining budget net of reservations, typed actions, and on errors a namespaced blockedBy plus typed recovery actions (or an explicit stop). Field names are normative. If every vendor renames them, nothing composes.
Gate — a suspended action waiting on a human decision. The agent polls; the human decides; the agent cannot self-approve.
Mandate — a human-signed spend ceiling, cryptographically bound, optionally verifiable offline. Authority travels with the credential, not with a trust-me row in a vendor DB.
Two-phase budget — reserve at quote, commit at apply, release on expiry or cancel. The only budget math that survives concurrent agents.
Human principal — the accountable person. Not a “payment peripheral” the agent notifies. The principal is the authority the system is designed to protect and route to.

We published these as an open specification under CC BY, with a JSON Schema for the envelope and a conformance checker you can point at any deployment. SproutPad's isolated public fake-money sandbox is live as a bounded beta. Signed self-conformance history remains a preview until its retained live drills and activation gate pass. One implementation is a demo. The vocabulary is an invitation for a second.

What this is not

The design does not prevent agents from spending. Agents that cannot spend cannot ship. The goal is spend that is authorized, bounded, attributable, and reversible where possible, with an explicit gate where it is not.

Nor has SproutPad solved agent safety in general. Prompt injection, tool confusion, and compromised credentials remain real. A governor assumes the agent may be fallible or compromised. Nothing in the design depends on the agent being well-behaved. That is why refusal is a first-class outcome, not an embarrassment.

It is not FinOps rebranded, either. If your product’s primary artifact is a chart of spend after the fact, you are in a different category. Charts are welcome. They are not the control plane.

Coming out

I am Rob Mine. I built SproutPad (the public name for the system we also call AgentInfra internally) because the provisioning layer was getting solved by platforms with distribution we will never match, while the governance layer remained a collection of alerts, per-provider caps, and hope.

We run a live service. The numbers are small. We publish them anyway. Tiny honest numbers beat large unverifiable ones. You can grade the production counters, cryptographic AP2 verify path, and isolated fake-money sandbox without believing a word of this essay. Signed conformance history will join that evidence set only after its launch gate passes.

If your agent already has a credit card — and it probably does — the question is not whether it will spend. The question is whether anything structural stands between the intent and the side effect.

Grade us. Don’t believe us.

— Rob Mine

Verify

# Live production aggregates (domains, ledger rows, gate outcomes)
curl -sS https://sproutpad.ai/transparency | jq .

# Envelope schema — the normative wire format
curl -sS https://sproutpad.ai/spec/envelope.schema.json | jq '.title, .required'

# Public fake-money sandbox; check runtime health before use
curl -sS https://sproutpad.ai/sandbox | head
curl -sS https://sproutpad.ai/.well-known/sandbox-health.json | jq .
curl -sS https://sproutpad.ai/conformance | head

For a shared sbp_… sandbox proof ID, agents connected over MCP can call verify_sandbox_proof now to recompute the digest and verify its signatures and AP2 chain. verify_architecture remains fail-closed until signed self-conformance activation. Unavailable is not evidence.