The 37-of-49 number is the one worth sitting with: moving money is the easy part, stopping it is the hard part. Your point that prompts are not spending limits is the right frame, and the framework survey backs it up: 0 of 12 frameworks know what a tool call costs, so the guardrail has to live in the payment layer.
The strongest structural fix in your census is the single-use credential, and it goes further than a budget field. If the agent never holds a standing key, replay stops being a risk: there is no durable credential to replay, and a prompt injection can propose a payment but nothing executes until a separate context authorizes it against an amount, a payee and a deadline. That turns human approval from a checklist item into a real gate.
That propose, confirm, execute split is the pattern we build around at CAI: the agent proposes, the user confirms, a short-lived authorization executes. No standing key for the model to lose.
Grandparents and family read Persian children's stories aloud on video, so kids growing up far from home keep their mother tongue in a voice they love. Real family voices, never AI.
Agreed: no standing key means nothing durable to replay or leak, and a prompt injection can at most propose. Propose, confirm, execute with a short-lived authorization is the cleanest way I know to make human approval a real gate rather than a checkbox.
The one addition I would make is that most payments should never reach the confirm step at all: rules decide the routine ones, and only the exceptions go to a person, otherwise people start approving without reading.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
The 37-of-49 number is the one worth sitting with: moving money is the easy part, stopping it is the hard part. Your point that prompts are not spending limits is the right frame, and the framework survey backs it up: 0 of 12 frameworks know what a tool call costs, so the guardrail has to live in the payment layer.
The strongest structural fix in your census is the single-use credential, and it goes further than a budget field. If the agent never holds a standing key, replay stops being a risk: there is no durable credential to replay, and a prompt injection can propose a payment but nothing executes until a separate context authorizes it against an amount, a payee and a deadline. That turns human approval from a checklist item into a real gate.
That propose, confirm, execute split is the pattern we build around at CAI: the agent proposes, the user confirms, a short-lived authorization executes. No standing key for the model to lose.
Agreed: no standing key means nothing durable to replay or leak, and a prompt injection can at most propose. Propose, confirm, execute with a short-lived authorization is the cleanest way I know to make human approval a real gate rather than a checkbox.
The one addition I would make is that most payments should never reach the confirm step at all: rules decide the routine ones, and only the exceptions go to a person, otherwise people start approving without reading.