The problem

Agents can now call APIs, buy services, and trigger paid actions. Policy checks alone are not enough — an agent can simply ignore the check. If the execution path does not require authorization, the policy is an opinion, not a gate.

The model

NO authorization → NO execution

Agent → SpendShield → authorization receipt → Execution Gateway → Payment

  agent
   |
   v
SpendShield ── policy: ALLOW / APPROVAL / DENY
   |
   | ALLOW -> one-time authorization receipt (signed grant)
   v
Execution Gateway ── verifies receipt, then and only then:
   |
   v
  Payment

One-time receipt: replay a spent grant → refused. Forge one → refused. No receipt → refused. The gateway only moves money with a valid, unconsumed grant.

SpendShield on GitHub · watch the demo · execution demo output