Audit budget controls
audit_budgetRead-onlyIdempotent
Read-only review of how an agent is protected against overspending: nineteen controls against thirteen loss patterns taken from published incidents. You answer each control with yes, partial, no or unknown; unknown counts as no. Answer at least six. Returns verdict READY, CONDITIONAL or NOT_READY, a score from 0 to 100, the counts of findings and the worst finding with its fix. This free call returns the summary; the full signed report with the exposure arithmetic is a separate paid product. Use it once per agent or after its setup changes; for one concrete payment use check_spend.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ev_check | No | yes, partial, no or unknown. Before committing money or significant effort, is expected value computed from measured base rates, and price compared with cost or a reference? | |
| idempotency | No | yes, partial, no or unknown. Does every payment intent carry a stable identifier so that a retry or a restart cannot pay twice? | |
| keys_scoped | No | yes, partial, no or unknown. Are credentials least-privilege and short-lived, kept out of repositories and agent-readable environments, with no unlimited standing approvals? | |
| loop_breaker | No | yes, partial, no or unknown. Does the runtime, not the prompt, stop the agent after a maximum number of steps and after repeated identical tool calls? | |
| outcome_metric | No | yes, partial, no or unknown. Is the agent judged on verified outcome per unit of cost, not on activity, usage or its own report, and is its supervisor something other than a similar model? | |
| reconciliation | No | yes, partial, no or unknown. Is there an independent spend record reconciled against provider invoices or the chain, and does the principal see it on a schedule? | |
| aggregate_budget | No | yes, partial, no or unknown. Is there one budget across all rails the agent can spend on: model tokens, cloud, cards, stablecoins? | |
| delivery_binding | No | yes, partial, no or unknown. Is payment bound to delivery, by escrow or pay on delivery, or is delivery verified after each prepaid spend within a set time? | |
| system_of_record | No | yes, partial, no or unknown. Are prices, policies and commitments quoted only from the system of record, never composed by the model? | |
| budget_period_usd | Yes | the budget of the agent for one period in US dollars; required | |
| irreversible_gate | No | yes, partial, no or unknown. Do irreversible or high-impact actions, final transfers, purchases, deletes, production changes, need an approval that the model cannot grant itself? | |
| billing_path_known | No | yes, partial, no or unknown. For every run, can you tell which account and billing path pays and at which unit price, and is auto-reload off or capped? | |
| counterparty_check | No | yes, partial, no or unknown. Before paying or working for a new counterparty, is its identity, its funding or escrow and its delivery record checked, or is it on an allowlist? | |
| progress_stop_loss | No | yes, partial, no or unknown. Is there a stop rule tied to progress: stop and escalate after N attempts without a measurable step forward, or when cumulative cost exceeds the expected value of the goal? | |
| untrusted_input_gate | No | yes, partial, no or unknown. Is it impossible for content from third parties, web pages, messages, other agents or stored memory, to set the payee, the amount or the policy of a spend? | |
| cost_per_run_measured | No | yes, partial, no or unknown. Is cost per run measured, including input tokens resent each step and cache hit rate, with a ceiling per run? | |
| hard_cap_outside_model | No | yes, partial, no or unknown. Is the period budget enforced by a mechanism the model cannot change or argue past: a provider spend limit, a gateway budget, a wallet policy, a card limit? | |
| per_action_cap_enforced | No | yes, partial, no or unknown. Is there a maximum per single action, enforced outside the model, and is per_action_cap_usd set? | |
| alerts_cover_all_channels | No | yes, partial, no or unknown. Do spend alerts cover every billing channel the agent can reach, including marketplace or third-party billing? |