AI agent governance stops being theoretical when agents can pay

Most AI agent governance policies were written for a world where the agent recommends and a person decides. They talk about oversight, review and human-in-the-loop, and they were sensible when the worst outcome was a bad draft. Then agents got payment credentials. The policy still says a human approves material decisions; the agent settled 400 payments overnight; nobody is quite sure whether that counts. This piece is about closing that gap: what authority should look like when it is delegated to software, and the four questions you will be asked afterwards.

The assumption that quietly failed

Read almost any AI policy written before 2025 and you will find a load-bearing assumption: the model produces output, a person acts on it.

Everything follows from that. Review processes assume something to review. Approval gates assume time to approve in. Accountability assumes a named human who pressed a button.

An agent that pays for an API call at 03:00 breaks all three. There is no output to review; the output was the payment. There is no time to approve, because the cycle completed in 400 milliseconds. And there is no human who pressed anything.

This is not a reason to panic. It is a reason to notice that ai agent governance for spending agents needs different mechanics, not just stronger wording.

Authority, delegated properly

Borrow from how organisations have always delegated spending authority to people, because that problem is solved and the solution transfers well.

A purchasing authority for an employee has four properties. It is granted by someone who had it to give. It is bounded by amount. It is scoped to categories or suppliers. And it expires.

Agent authority should have exactly the same four, with one addition: it must be enforced somewhere the agent cannot reach.

That last clause is the whole difference. An employee with a £500 limit who spends £2,000 has committed misconduct; the limit was social, and the enforcement is consequences after the fact. An agent has no career to damage. A limit that exists only as words in a system prompt is not a limit; it is a suggestion in the same channel as every other instruction the agent reads, including hostile ones.

"Every governance conversation we have eventually arrives at the same sentence: the budget cannot live in the prompt. Once a team accepts that, the rest of the design falls out in about an hour."

the Spend7 engineering team

What good ai agent governance looks like

Table: the five properties of delegated spend authority, in the form most organisations have them and the form that survives an audit.

The right-hand column is not more bureaucratic than the left. It is mostly the same decisions, written somewhere that can enforce them.

Mandates: governance the merchant can verify

AP2, published by Google in September 2025, is the first serious attempt to make delegated authority portable. Its mandates (signed objects recording what a human approved) borrow from the W3C Verifiable Credentials model, so a merchant can verify authority rather than take it on trust.

For governance this is a real advance on one specific question: who authorised this, and to what extent? Before mandates, that question had no artefact behind it at all.

But be precise about the scope of the improvement. A mandate does not know how many other mandates that agent is operating under today. It cannot tell you the agent was manipulated into a purchase you technically permitted. And it does not record what was known at settlement. We covered the limits in AP2 payment safety.

Mandates answer one of the four audit questions well. The other three need something else.

The four questions

When something goes wrong, and eventually something does, the questions arrive in a predictable order.

1. Who authorised this? A named person, a scope, a date. If the answer is "it was deployed in March", that is not an authority, it is an accident of history.

2. How much was it authorised to spend? A number, held somewhere the agent could not edit. "It was told to be careful" is not a number.

3. For how long? Authority that never expires accumulates. An agent granted a budget in January and still running in August is operating on an authority nobody has revisited.

4. What was known at the time? This is the one that decides outcomes, and the one almost nobody can answer.

Because the honest reconstruction is usually: we know £18,400 left, we know which counterparty, and we do not know whether anything looked wrong beforehand, because nothing was checking.

A decision record written before settlement answers question four. It is evidence rather than reconstruction, precisely because it could not have been influenced by knowing how things turned out. That is what an evidence packet is for, and why it records the ruleset version and hash in force at the time, so a payment argued over in October is argued against the thresholds that actually applied in August, not against whatever they became.

A worked example

A finance team grants a reconciliation agent authority to settle supplier invoices under £2,000, from an approved supplier list, reviewed quarterly.

In enforceable form that is: a per-transaction cap of £2,000, a rolling daily cap of £8,000, a merchant allowlist, and a calendar reminder.

Six weeks later the agent attempts £4,600 to a supplier not on the list. Denied twice over, on both the amount and the allowlist. The record shows the attempt, the caps evaluated, and the counterparty.

The follow-up takes eleven minutes. Someone reads the record, sees a legitimate new supplier onboarded by a colleague who did not know about the list, adds them, and re-runs.

Now the version without enforcement. The agent pays. Nobody notices for five weeks. When the invoice is queried, the reconstruction takes four days and ends in a meeting about whether the agent was ever supposed to do that. Same underlying situation. The difference is entirely in whether the authority was written somewhere that could act on it.

Where the ai agent governance frameworks fit

Your compliance team will want this mapped onto something recognised.

The NIST AI Risk Management Framework is the usual vocabulary in the US and maps cleanly enough: bounded authority is a governance control, pre-settlement scoring is measurement, the decision log is traceability. In the EU, the AI Act sets obligations by risk category and has more to say about oversight than about payments specifically.

Neither was written with an agent holding a payment credential in mind. Both are perfectly usable as scaffolding, provided you accept that the concrete controls (caps, allowlists, expiry, evidence) are yours to build.

Common ai agent governance pitfalls

Policy without enforcement. A document saying agents may spend up to £500 is not a control. Ask where the £500 is stored and what happens if the agent tries £600.

Authority that never expires. Grants accumulate. Nobody revokes. Set expiry at grant time.

One shared identity across a fleet. If every agent presents as the same caller, none of the four questions has a per-agent answer.

Logging outcomes only. A ledger of payments made answers question four with silence.

Treating a flag as a formality. If your system flags a payment and settles anyway, you have documented that you were warned. That is worse than not checking.

Start here

The mechanics are less work than the policy. Spend limits for AI agents covers scopes and windows, autonomous agent payment monitoring covers what to watch, and the API reference shows the decision record you will be very glad to have.