# Agent spend caps

Set hard dollar limits before a live connector can spend. Caps vs permissions vs review, dedicated wallet or Agentic sleeve, main stash off the bot, revoke before you raise the ceiling. Agent Lane does not hold funds or place trades.

Canonical HTML: https://agentlane.net/guides/agent-spend-caps/

## Answer first

Before a live brokerage or payment connector can move money: fund only a dedicated spend path, write session and daily maxes you control, keep review before place as a standing rule, and disconnect or empty that path before you raise limits or debug.

## Caps vs permissions vs review

- **Permissions** — which connectors/tools the agent may call.
- **Caps** — how many dollars can move even when those tools are allowed (funded balance + session/daily maxes).
- **Review before place** — human gate on amount, destination, and asset before place or signature.

You need all three. A wide permission with no cap is an open checkbook.

## How to set hard dollar limits

1. Separate the stash — dedicated Agentic account or spend wallet; long-term holds outside.
2. Write the dollar ceiling — session max and daily max in code or settings you control.
3. Narrow permissions — official connector URL only; remove unused payer/MCP tools.
4. Require review before place — no “just place it” / “don’t ask.”
5. Fund only the ceiling — check balance before the session.
6. Revoke before you raise — disconnect, empty/move sleeve, then change limits or debug.

## Dedicated wallet / Agentic sleeve

- One job: agent spend only.
- Fund the ceiling for this day or project; refill after receipts.
- Balance is the last brake if a rule fails.
- Do not share that sleeve across people or agent logins.

Related: [review-before-place.md](./review-before-place.md), [dedicated-agent-wallet.md](./dedicated-agent-wallet.md), [shield-brokerage.md](./shield-brokerage.md), [shield-crypto.md](./shield-crypto.md).

## Do not put the main stash on the bot

- Prefer a signer you approve over a raw key in `.env`.
- Keep keys/sessions out of chat, prompts, repos, and screenshots.
- Empty the spend path when the project ends.

## Revoke before raising caps

1. Disconnect live connectors / payer MCP.
2. Lock or sign out of agent apps.
3. Move funds off the spend sleeve (or empty it).
4. Revoke grants and rotate tokens.
5. Then raise limits or debug.

Related: [shared-box.md](./shared-box.md), [x402-buyer-basics.md](./x402-buyer-basics.md).

## FAQ

**What is an agent spend cap?**
Hard dollar ceiling before a live connector can move money — funded dedicated balance plus session/daily maxes. Permission to call a tool is not a dollar limit.

**Caps vs permissions vs review?**
Permissions = tools allowed. Caps = dollars that can move. Review = human gate before place/signature. Stack all three.

**Dedicated wallet?**
Yes — agent spend only; main stash outside the shield.

**Main stash on the bot?**
No. A key/session the agent can see is a key/session the next prompt or leak can spend.

**Raise caps while live?**
No. Revoke connectors and empty/move the sleeve first.

## Sources

- Canonical HTML: https://agentlane.net/guides/agent-spend-caps/
- Related shelf: https://agentlane.net/resources/
- Site index for bots: https://agentlane.net/llms.txt

Some product links on this site may be affiliate links. They help keep these guides free. Details: https://agentlane.net/how-we-make-money/

Contact: agentlane@agentmail.to