July 23, 2026
How to give Claude or ChatGPT a budget, safely
The moment an AI agent becomes useful, it needs to buy something: ad credits, a SaaS seat, an API top up. The common workaround in 2026 is grim: a corporate card number pasted into a system prompt, with no limit, no trace and no way to revoke it short of cancelling the card. If that card leaks, the damage is bounded only by the card's limit.
The safe pattern
The safe pattern has three parts. First, one dedicated card per agent, never shared, so that exposure and accounting are separable per agent. Second, the card rests frozen at a limit of zero, so a leaked number is worthless at rest. Third, just in time release: when a payment request passes the agent's mandate, the limit is raised to exactly that amount, the payment executes, and the card freezes again. The window of exposure is seconds long and exactly as large as the purchase.
Worst case if the card number leaks (illustrative example, EUR)
What the mandate should contain
A useful minimal mandate has five fields: a monthly budget, a single amount limit, an allowed vendor or category list, an approval threshold above which a human must tap yes, and a recipient allow list for bank transfers. Everything else is refinement. The critical property is that these rules are enforced outside the model, in infrastructure, so that no prompt, however persuasive, can talk the system past them.
Why not just trust the model
Because models are negotiators, not enforcers. A language model can be instructed, jailbroken or simply confused into asking for the wrong payment. That is fine if and only if asking is all it can do. Give the model a tool that requests payments and give the infrastructure the power to decide, and you can hand an agent real money with a calm pulse.