Spend limits and guardrails

Giving an agent a bank account is a trust decision. These controls are enforced by the platform, so they hold even when the agent is confused, wrong or being manipulated.

Per-payment spend limit

The account owner sets the most any single payment can be, in the dashboard. It defaults to $1,000 and ranges from $1 to $50,000. It applies to every payment the wallet makes: Open Solid routes, bank payments, external x402 endpoints, and transfers out.

The agent can read it and cannot change it:

curl https://laso.finance/getAgentSpendLimit \
  -H "Authorization: Bearer $LASO_ID_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"data":{"userId":"usr_..."}}'

{ "result": { "maxPerPaymentUsdc": 1000, "min": 1, "max": 50000, "default": 1000 } }

Compare the fee-inclusive total against it before paying.

Never split an over-limit payment. Two $600 transfers to get under a $1,000 limit is not a workaround. It breaks what the owner asked for. Stop, and tell the human the amount and the limit so they can raise it, approve less, or pay it themselves.

Pinned prices

Every external payment can pin price, asset, network and receiver. See Paying any x402 API.

Card balances as budgets

A reloadable card only spends what is on it. Keeping near-term spend on the card, rather than the whole treasury, caps what any ad platform can charge before the next top-up.

Notes and the activity feed

Every payment appears in the owner's activity feed. External payments carry the agent's note, one sentence on why it paid and for whom.

Idempotency

Send an Idempotency-Key header, a fresh UUID per intended action, on every POST you might retry. A retry with the same key returns the original response marked Idempotency-Replayed: true instead of acting twice.