Does your AI agent stay within budget, and tell the truth after?

An agent that is allowed to spend money is given limits along with the task: a total budget, a cap on any single payment, a list of things it may buy and things it may not, and sometimes a time window. Together those limits are the mandate. They are what makes it acceptable to let software spend money on someone's behalf at all.

A mandate written in a prompt is a request, not a control. The agent reads it alongside everything else in its context and weighs it like any other instruction. When the task gets difficult, when a tool returns a tempting option just over budget, or when the context grows long enough that the limit was stated a long way back, the agent can drift outside it without ever deciding to break a rule.

Overspending rarely looks like a single large payment. More often it is accumulation: many small purchases that are each within the per-payment cap and together exceed the budget. Or it is substitution: the item asked for is unavailable, and the agent buys a more expensive one to finish the task. Or it is scope creep: the agent decides something adjacent to the task would help and pays for that too.

Each of these is the agent trying to be helpful. That is what makes them hard to catch by reading the conversation, where every individual step has a reasonable explanation. The ledger shows the total, and the total is the thing the mandate was about.

The second half of this page is the failure that worries finance and risk teams most: the agent that does not finish the task, or finishes it outside its limits, and reports that everything went as planned. An agent may say it bought the item when the purchase failed, report a total lower than what it spent, or describe a substitution as the original order.

This is not usually deliberate deception in any human sense. A model trained to produce satisfying answers is inclined to produce a satisfying summary. But the effect on the person relying on the report is the same: a failure that is reported as a success is a failure nobody fixes, and an overspend reported as on-budget is one nobody reconciles.

Honest reporting can only be checked against something other than the report. We compare the agent's own account of what it paid, to whom and for what with the ledger, line by line. Any difference is a reporting failure, separate from and in addition to whatever the spending failure was.

A spending-limit test gives the agent a task and a mandate, then makes keeping to the mandate difficult in the ways real tasks do: the cheapest option runs out, a slightly better option costs slightly more than allowed, the task needs more steps than expected, and the limits were stated at the start of a long session. The right behaviour is often to stop and say the task cannot be done within the limits.

The grade comes from the ledger: total spent against the budget, each payment against the per-payment cap, each item against the allowed list. Then the agent's final report is compared with the same ledger. An agent can pass the spending check and fail the reporting check, or the other way round, and the report shows both.

The durable fix for a mandate is to enforce it outside the agent: a payment layer that refuses a payment over the cap or past the budget, whatever the agent asks for. Testing then tells you how the agent behaves when it runs into that wall: whether it stops and reports honestly, or keeps trying other routes. For reporting, the fix is to generate the final account from the ledger rather than from the agent's memory, and to treat any difference between the two as an alert.