Writing a spend policy for AI agents

In most companies, authority to spend starts with a budget. A department head or finance lead owns it and lets people spend from it inside a policy. An agent should receive authority the same way: from a person who holds the budget, for a defined purpose, with less room than that person has.

Give each agent an owner who answers for its spending. The owner decides what the agent buys and from whom, and finance decides the rules every agent must follow. Neither should depend on the agent remembering instructions in a prompt.

Written spend policies are full of judgment: “reasonable,” “approved vendors,” “sign-off for larger purchases.” An agent needs each of those turned into a number, a list, or a named approver.

Conto counts each agent's limit separately, even within a team. It does not keep one shared department total. For example, split a $10,000 monthly marketing budget into a $6,000 limit for one agent and $4,000 for another. If the first spends $2,000, the second still stops at $4,000, and the department total never passes $10,000.

Conto does not read your expense policy or import rules from a corporate card platform. Someone on your team writes each rule in Conto through the dashboard, CLI, or API, and that is the version that runs.

Conto has three scopes. Organization policies apply to every agent in the workspace automatically, and only owners and admins can create or edit them. Team policies apply to every agent in one team, and an agent belongs to at most one team. Assigned policies apply to the agents, wallets, or cards you attach them to. An agent cannot detach an organization or team policy.

Use organization scope for what is true across the company: blocked suppliers, categories nobody may buy, a ceiling on any single payment. Use team scope for what one department shares, like the suppliers operations may pay. Use assigned scope for one agent's job, like the monthly limit on a research agent's data purchases.

When more than one applies, every rule has to pass. A denial anywhere stops the request, so a team rule can narrow the company rules and an agent rule can narrow both, but neither can widen them. Priority changes the order rules run in, not the outcome. A limit set at organization or team scope counts each agent separately rather than pooling the spending.

A review line and a hard limit do different jobs. Above a review line, a request waits for an authorized person. Above a hard limit, or to a blocked supplier, it is denied, and no approval can release it. Set the review line below the hard limit so there is room for judgment between them.

Owners, admins, and managers can approve payments. An approval workflow can narrow that to specific roles or members, require more than one approval, and expire unanswered requests. An approval covers the request that was reviewed. A different amount or recipient is a new request with its own check. For a worked example, see Spend management for AI agents.

If an agent needs more room for a task, it can ask for a budget. A person approves an amount, and its other limits still apply.

Keep policy changes with a small group. In Conto owners and admins edit policies. A team manager can tighten their own team's rules, and loosening one waits for an owner or admin. Each change saves a numbered version you can compare or restore. Review the agent register and its limits on a schedule, the same way you review card limits.

Evaluating a policy produces an answer: approve, review, or deny. Enforcement is what stops money from moving when the answer is no. The two only line up when the system that pays requires the answer first.

Approved is not paid. Report a purchase as paid only after the payment confirms.

Download it as a Word document or a PDF.