# Where a cap is enforced

Lesson 1 of [Set and test spending controls for AI agents](https://agentwalletindex.fyi/academy/test-agent-spending-controls.md), 12 minutes.

A cap is only as strong as the place that enforces it. Ask this about every limit: who enforces it, and can the agent change it?

## Four places

1. **The agent's instructions.** A line in a prompt asks the model to stay under budget. The model can misread it, ignore it or be tricked. This is a request. It is not a cap.
2. **Your own code around the agent.** A check in your code can refuse a payment. It is stronger than a prompt. But a bug in the same code can skip it, and anyone who can change the code can change the check.
3. **The wallet or platform.** The vendor's service refuses a payment that breaks a rule. The agent cannot change the rule when it has no access to the settings.
4. **The money itself.** The balance in the wallet, the limit on a card or a limit set onchain. A wallet that holds one week of budget, and does not top itself up, cannot spend more than that.

Put each limit where the agent cannot change it. Use more than one place.

## Why a prompt is not enough

OWASP lists Prompt Injection as a risk for applications that use a large language model. Text in an input can change what the model does. OWASP also lists Excessive Agency. It describes a system that has too much functionality, too many permissions or too much autonomy. An agent that can spend with no cap has more permission than its task needs. A spending cap takes some of it away.

## Keys

With self-custody, a signing key may sit with the agent or its host. Then anyone who can read that environment can spend. Keep keys out of prompts and logs. Use a separate key for each agent, so you can revoke one without stopping the rest.

## Ask this for every cap

- Where is it enforced?
- Who can change it?
- What does the vendor's doc say, and where?

## Sources

- OWASP, Top 10 for LLM Applications 2025, Prompt Injection and Excessive Agency
- Agent Wallet Index, Agent Spend-Limit Checklist, steps 2 to 4

Also on the [web page](https://agentwalletindex.fyi/academy/test-agent-spending-controls/where-a-cap-is-enforced).