What it means to give an AI agent a budget

Every product demo in this category has a slider. The number on the slider is called a budget, and I have come to think the word is doing too much work. An AI agent spending limit answers one question, which is how much. A budget answers five, and four of them are about the moment the answer is no.

Five questions a budget has to answer

• Per transaction. The largest single purchase the agent may make without asking, in a currency, at a merchant, inside a category.
• In a window. The cumulative amount over a period that resets, and the number of transactions inside it. This is the limit that actually protects a balance.
• Under what authority. Which merchant, which category, which kind of action. A budget without a destination is a spending cap for a stranger.
• What happens at the edge. Allow, deny, or stop and ask. And the rounding case, because 149 is not 150 and someone has to decide before the user finds out.
• When it stops being true. The date the budget expires, and the condition that kills it earlier. Scoped capabilities that expire, not a standing permission with no end.

Every one of these exists in somebody's product, and almost no product has all of them. The slider is number one. The other four are the difference between a limit and a boundary.

What people say they would tolerate

The useful thing about this market is that the numbers are being surveyed while it is still small, and the survey answers are not the numbers the pitch decks assume. Checkout.com ran a study across six markets in June 2026 and found an average delegation tolerance of one hundred and seventy seven pounds per purchase, against a merchant side assumption of two hundred. So the merchants already overestimate by about a tenth. It is a vendor survey and I am treating it as direction, not as truth, but the direction is consistent with everything else.

The same study asked what people would not give up, and the top answer was spend caps at thirty per cent, then instant revocation at twenty nine, then easy cancellation at twenty eight. Read that ordering carefully. Nobody put model quality anywhere near the list. They put control first, immediacy second, and an exit third.

Now the harder number. Gartner surveyed 322 United States consumers in May 2026 and found that eleven per cent would let an AI make a purchase decision on their behalf, rising to around thirty one per cent if it only narrows the choice for household supplies. Visa's 2026 Global Digital Shopping Index found that forty eight per cent used AI to research their last purchase while thirty five per cent would grant an agent access to saved payment credentials. There is a twenty point drop between letting a tool help me choose and letting it spend.

And sentiment moved the wrong way in a single quarter. Riskified reported that fifty five per cent of respondents were not comfortable with agents completing purchases, down from seventy per cent in the previous quarter. Twenty year old reasoning says autonomy is about to explode. The surveys say the room is getting colder while the demos are getting better.

Why the number is the easy part

A budget is a promise about the future made by someone who will not be present. The interesting engineering is not the comparison, it is the bookkeeping around it: concurrent requests that all check the same remaining amount, a retry that looks like a second purchase, a partial refund that has to give the money back to the right window, and a ledger that has to be able to reconstruct the remaining amount a year later without trusting the database that computed it.

That is why my budgets are evaluated in the same transaction that records the decision. If the check and the write are two steps, an agent that retries aggressively can pass the check twice. This is the same race that an external audit found in my authorization endpoint when it checked the budget, wrote the decision, then recorded the idempotency key, in that order and convinced of its own linearity. The budget you can explain on a slider is the easy half. The budget that survives a hundred parallel requests is the one worth having.

Two more cases break naive budget arithmetic, and both are ordinary. A partial refund has to return the money to the window it came out of, not to the current one, otherwise a subscription that cancels halfway through the month silently restores spend capacity. And a currency change has to be handled at a stated rate and a stated time, because an agent spending euros against a limit written in dollars is either guessing or using a rate that will change tomorrow.

Neither is exotic. Both are the reason I stopped treating a budget as a comparison. A comparison is one line of code. A budget is a small accounting system, and it should be built like one, because the moment someone asks where the remaining two hundred went, the answer has to be reconstructable rather than recalculated.

What I would write on the boundary, before shipping it

Spend up to four hundred a month at these three suppliers for tools and hosting. Nothing that renews automatically, and nothing I have to cancel. Ask me above a hundred and fifty, in the moment, and I do not have to be awake. It all ends on the last day of the month, and I can pull all of it from my phone in one action. Anything outside that, the agent tells me and stops.

That sentence is five answers to the five questions, it is a sentence a person would actually say, and it is what a policy document should compile into. The engine that evaluates it is in designing an agent policy engine, the credential question in an AI agent should never have your credit card, and the record it leaves in what an agent authorization record should contain. I am building it at Noesia, and the argument it serves is the money layer for AI agents. The short version of the trust argument is the agentic economy is a trust problem.