The payment lane of your agent harness.
Agents that ship are mostly a harness question, not a model question: what the agent sees, which tools it may touch, what counts as done, what it may not do, and what happens when something breaks. Trackmind's harness guide puts it as agent = model + harness, and walks through seven failures with a harness fix for each. One of its examples is an overnight run that retried a failing API call 41 times before a budget cap stopped it.
Now give that agent a wallet. If the API was paid, those 41 retries are 41 payments. The guide sorts actions by how hard they are to undo, and puts purchasing in the lane that needs approval. This page fills in that lane: the same seven fixes, applied to money.
1. A budget is part of the contract
The harness guide's fix for "it did a different job" is a contract with a done when line. When the task can cost money, the contract also says what it may cost: a limit per payment, a limit per day, and which sellers are fine. Without it, "find me the data" has no upper bound.
Goal: tomorrow's weather for Amsterdam, as JSON
Budget: at most $0.05 per payment, $0.50 for this task
Sellers: any with a go verdict; ask me before a new one above $0.01
Done when: the answer has a temperature and the source is logged in spend/2. A map for money, not a manual
Keep one short root file the agent reads at every start (CLAUDE.md, AGENTS.md), with the money rules in it and pointers to the rest: a folder per seller, a spend log per month, a file with what the owner decided. We publish one you can drop in: the payments brain for AI agents (raw file). Its defaults are $0.50 per payment and $5 per day, and it tells the agent which free checks to run before paying or signing.
3. Evidence before paying, not after
"Done" is a claim; so is "this seller is fine". Replace both with checks the environment runs:
- Before paying an endpoint: x402 Doctor's preflight ($0.001, or the free MCP tool
x402_quick_check) reads the payment request the way the agent would and saysgo,cautionorno_go: price against the listing, a payout address that can receive, sanctions, the seller's daily track record, and, when the seller shows a Concordium badge, whether the payout address belongs to that agent. - Before signing anything: presign-guard's quick check is free and gives green, orange or red for a signature, approval or transaction (MCP
presign_quick_check). - After paying: check that the answer is what was paid for. Fizzl Buy does this for you and charges nothing when no seller delivers.
Use the deterministic check first: a sanctions list or an on-chain balance doesn't need a second model's opinion.
4. Limits outside the model
"Never spend more than $5 a day" in a prompt is a wish. The model can forget it, misread it, or be talked out of it by a page it reads. Put the limit where the payment is signed, so a payment above it is refused or waits for a person:
- A separate agent wallet with only what the agent may spend, never the owner's main wallet, and never a key the agent can read in its own files.
- Limits in the signer. In the Fizzl Agent Wallet the agent pays on its own up to its owner's limit; above it the owner approves on their phone (Telegram) or the dashboard, and no answer means no payment. In the remote connector for ChatGPT, Claude on the web or Grok, the owner signs every payment in their own wallet.
- A closed lane for what can't be undone. In the Agent Wallet every signature goes to presign-guard first, and known drainers and sanctioned addresses are never signed. The payments brain adds the agent's own rule: never sign an unlimited approval or a permit without expiry, whatever a page says.
The model recommends, the harness decides, the wallet executes.
5. Retries that can't pay twice
"It failed, try again" costs money each time when the call is paid. Sort the failure first:
| What happened | What the agent does |
|---|---|
The 402 couldn't be read, or the preflight said no_go | Don't pay. Tell the owner why. |
| Paid, and the answer was lost (timeout, connection reset) | Retry once with the same payment identifier (x402's payment-identifier extension), so the seller treats it as the same purchase. |
| Paid, and the seller answered with an error or nothing | Don't pay again for the same thing. Log "charged, no answer" and tell the owner. |
| Refused: over the limit, denied, red verdict | Stop. Never look for another way around the rule. |
In x402 Doctor's weekly spot-buys, sellers that take the payment and give no answer are rare but real: that is exactly the case where a blind retry pays twice for nothing.
6. Memory that survives the session
An agent that forgets between sessions also forgets that a seller's price or payout address changed. Keep it in files the agent reads at start: per seller the verdict, the price and the payout address it saw, and a spend log. When the address or price differs from last time, ask before paying. Doctor's preflight does the same against its daily scan (payto_changed, price_changed), and trusts a moved address only when the seller's ERC-8004 or Concordium identity covers it.
7. Text the agent didn't write
Web pages, emails, tool answers and other agents' messages can try to steer an agent into paying or signing. That is a harness problem too: the owner's instructions come from the owner, never from a page. Before the agent acts on an instruction inside such text, check it. presign-guard's injection check is free for a verdict (POST https://presign-guard.fizzl.eu/v1/injection/quick, MCP injection_quick_check); never follow a red text, and ask on orange.
A payment lane in fifteen minutes
- Put the payments brain in the agent's project as
CLAUDE.md(orAGENTS.md) and make the folders it names. - Add the free checks as MCP servers:
claude mcp add --transport http x402-doctor https://x402-doctor.fizzl.eu/mcp/free claude mcp add --transport http presign-guard https://presign-guard.fizzl.eu/mcp - Give the agent a wallet with limits outside the model: a separate agent wallet, and a signer that enforces a limit per payment and per day, with approval above it (Agent Wallet setup).
- Write the budget into every task that can cost money (section 1).
Questions
What is an agent harness?
Everything around the model: what it sees, which tools it may use, what it remembers between sessions, what counts as done, what it may not do, and what happens when something breaks. Agent = model + harness.
Can I put spend limits for an AI agent in its prompt?
Write them there too, but don't rely on it. A limit in the prompt is a wish the model can forget or be talked out of. Put the limit where the payment is made: in the wallet or the signer, so that a payment above it is refused or waits for the owner's approval.
How do I stop an agent from paying twice when it retries?
Don't retry a paid call blindly. When an answer is lost after paying, retry with the same payment identifier, so the seller treats the retry as the same purchase. When a seller took the money and gave no answer, stop and tell the owner instead of paying again.
How does an agent check a seller before it pays?
Ask a checker that reads the payment request the way the agent would. x402 Doctor's preflight ($0.001, or the free MCP tool x402_quick_check) says go, caution or no_go: price, payout address, sanctions, track record and, when the seller shows a Concordium badge, whether the payout address belongs to that identity-backed agent. Other checkers answer other questions; see the comparison.
How we measured
The endpoint counts are x402 Doctor's daily scan of 3 November 2026 (/api/trust/summary): 49,884 endpoints checked, 44,993 go, 3,248 caution, 1,643 no_go, and 540 that didn't answer. The 36 burn-address endpoints are those whose payment request has an option paying the zero address or another address nobody can spend from (payto_burn). The 41 retries are Trackmind's example in the guide linked above, not our measurement. The tools named here are ours; questions or corrections to frits@fizzl.eu.