Agent Payment Security Checklist

Every payment carries a verifiable agent identity. Anonymous or forged identity must not reach a budget.

A shared pool means one agent's spend starves — or blames — another. Per-agent budgets + a global ceiling is the sane minimum.

If the default is "fall back to global policy", fine — as long as it's an explicit decision. Accidental default-allow is how budgets get bypassed.

Same request + same policy = same decision, every time, in code — not "ask the model". The agent must not be able to argue its way past a rule.

A hard ceiling on any single payment, independent of budgets.

And are they cumulative — does splitting one $200 spend into five $40 calls still get caught?

Block known-bad recipients outright; trust list can skip approvals. Exact-domain matching, no prefix games.

This is the pragmatic prompt-injection defense: an agent that read "refund $500 to scam-vip.com" hits "new recipient / over approval line → human, or deny".

A policy check is an opinion. If the execution path doesn't require the authorization (signed, single-use grant), the gate is decorative. No receipt → no execution.

If it has the card and a payment tool, there is a second path around your gate. The agent should hold no credentials.

Can an old authorized request be replayed after success? Grants and intents must be single-use.

There must be a durable execution-intent record (reserved → in-flight → succeeded/unknown), not just an in-memory decision. After restart, the system must know exactly what happened.

The rail timed out but actually settled. Retry pays twice. Outcomes must be reconciled against the durable record, not assumed from the last HTTP response.

Two parallel requests must not both pass a $50 remainder. Reservation and consumption must be atomic (one transaction), not read-then-write.

An unreachable outcome must stay budget-occupied until proven settled-or-not — releasing it early is how double spends happen.

Every decision logged with who/what/why. Chain the entries (hash-linking) so editing history is detectable. This is your evidence if anything is disputed.

Unconfigured channel, dead webhook, human asleep — if the fallback is "allow", the gate is decorative. No channel available = deny.

Policy-as-code: versioned, diffable, deployable — not a magic config a model or admin edits inline.

You should be able to run the whole gate against real requests with zero money moving. Nobody should wire real payments on the first deploy.

Adversarial suite (injection, splitting, replay, races, tampering) + every found hole becomes a permanent regression test. Release blocked on any escape.