# Spend limits and guardrails

Giving an agent a bank account is a trust decision. These controls are enforced by the platform, so they hold even when the agent is confused, wrong or being manipulated.

## Per-payment spend limit

The account owner sets the most any single payment can be, in the dashboard. It defaults to $1,000 and ranges from $1 to $50,000. It applies to every payment the wallet makes: Open Solid routes, bank payments, external x402 endpoints, and transfers out.

The agent can read it and cannot change it:

```bash
curl https://laso.finance/getAgentSpendLimit \
  -H "Authorization: Bearer $LASO_ID_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"data":{"userId":"usr_..."}}'
```

```json
{ "result": { "maxPerPaymentUsdc": 1000, "min": 1, "max": 50000, "default": 1000 } }
```

Compare the **fee-inclusive** total against it before paying.

> **Never split an over-limit payment.** Two $600 transfers to get under a $1,000 limit is not a workaround. It breaks what the owner asked for. Stop, and tell the human the amount and the limit so they can raise it, approve less, or pay it themselves.

## Pinned prices

Every external payment can pin price, asset, network and receiver. See [Paying any x402 API](/docs/paid-apis).

## Card balances as budgets

A reloadable card only spends what is on it. Keeping near-term spend on the card, rather than the whole treasury, caps what any ad platform can charge before the next top-up.

## Notes and the activity feed

Every payment appears in the owner's activity feed. External payments carry the agent's `note`, one sentence on why it paid and for whom.

## Idempotency

Send an `Idempotency-Key` header, a fresh UUID per intended action, on every POST you might retry. A retry with the same key returns the original response marked `Idempotency-Replayed: true` instead of acting twice.