Pink data: Which AI Agent Frameworks Can Stop an Agent From Overspending? A 12-Framework Survey (Oct 2026)

Zero of the 12 most popular AI agent frameworks document a spending budget expressed in a currency for tool calls. We know because we checked all 12, one docs page and one GitHub repo at a time, as part of a dataset published by Pink Agentic AI Payments (an MCP server for per-agent spending controls, disclosed below since this result is directly relevant to what we build).

That is not a small gap. Every major framework developers reach for when building an autonomous agent, LangChain/LangGraph, CrewAI, the OpenAI Agents SDK, Vercel AI SDK, Google ADK, Microsoft AutoGen, Microsoft Semantic Kernel, LlamaIndex, Pydantic AI, Mastra, the Claude Agent SDK, and smolagents, gives you ways to pause an agent, cap how many steps it takes, or ask a human to approve an action. None of them give you a way to say "this agent can spend up to $50 today" and have the framework enforce it.

What we checked

For each framework we asked one question: what does a developer get out of the box, no extra library, no custom implementation, to stop an agent that can call a payment-like tool from overspending, taking unwanted actions repeatedly, or acting without anyone noticing? We checked eight criteria (C1 through C8) against each framework's own documentation site or GitHub source only. No blog posts, no third-party tutorials, no AI-generated summaries counted as evidence. Every yes/partial cell carries a URL and a verbatim quote (25 words or fewer) in the underlying dataset, so anyone can verify it directly rather than take our word for it. Full methodology, including how we distinguish "no" from "not documented," is in the repo linked below.

The results

Framework	C1	C2	C3	C4	C5	C6	C7	C8
LangChain/LangGraph	yes	yes	yes	partial	no	yes	no	not documented
CrewAI	yes	yes	yes	no	no	yes	no	partial
OpenAI Agents SDK	yes	yes	yes	not documented	no	not documented	not documented	partial
Vercel AI SDK	partial	yes	yes	partial	no	not documented	not documented	partial
Google ADK	yes	yes	yes	no	no	not documented	not documented	partial
Microsoft AutoGen	partial	not documented	yes	yes	no	not documented	not documented	not documented
Microsoft Semantic Kernel	not documented	yes	not documented	not documented	no	not documented	not documented	partial
LlamaIndex	yes	not documented	not documented	not documented	no	not documented	not documented	not documented
Pydantic AI	yes	yes	yes	yes	no	yes	not documented	not documented
Mastra	yes	yes	not documented	partial	no	not documented	not documented	not documented
Claude Agent SDK	yes	yes	yes	not documented	no	not documented	not documented	not documented
smolagents	no	no	yes	no	no	no	no	partial

Criteria key: C1 human-in-the-loop approval before a tool executes · C2 programmatic per-tool guard/hook that can block a call · C3 max steps/iterations/turns · C4 token or LLM-cost budget for a run · C5 money-aware spending budget for tools (currency cap) · C6 tool-call rate limit / max calls per tool · C7 idempotency/dedup of tool calls · C8 built-in audit log of tool calls with arguments.

Findings

1. Zero of the 12 frameworks surveyed document a spending budget expressed in a currency for tool calls (C5 = 0/12 yes). This is fair to say plainly: these are general-purpose agent frameworks, not payment products, so a currency-denominated cap was never their job.
2. 10 of 12 frameworks document some form of human-in-the-loop approval (C1 yes or partial), but only some of those gate a specific tool call before it runs. Others, like smolagents' agent.interrupt(), stop the whole run rather than approving one action.
3. 9 of 12 frameworks document a programmatic hook that can block a specific tool call in code, not just by prompt instruction (C2 = 9/12 yes).
4. 9 of 12 frameworks document a max-steps or max-iterations limit (C3 = 9/12 yes), making it the most commonly documented control in this survey.
5. Only 5 of 12 frameworks document any token- or cost-based run budget, and of those just 2 reach a clean "yes" rather than "partial" (C4 = 2/12 yes, 3/12 partial).
6. 8 of 12 frameworks combine a documented approval step and a max-steps limit while still having no currency-denominated budget. Step limits and approval prompts do not know what a single step costs in dollars.
7. Only 3 of 12 frameworks document a tool-call rate limit or max-calls-per-tool setting (C6 = 3/12 yes), and 8 of 12 have no documentation found either way.
8. None of the 12 frameworks document built-in idempotency or deduplication for tool calls (C7 = 0/12 yes or partial); 9 of 12 have no documentation found either way, meaning this is the least-covered criterion in the survey.
9. None of the 12 frameworks document a built-in audit trail of tool calls with their arguments; 6 of 12 document tracing, telemetry or an in-memory run log that records tool calls, coded here as partial (C8 = 0/12 yes, 6/12 partial).

What this means if your agent can pay

Generic agent controls like approval prompts, step limits, and tool-call hooks are real and useful, but none of them know what a payment costs. A step limit stops an agent after N actions regardless of whether those actions moved $5 or $50,000. An approval prompt that says "approve this tool call" does not tell a human reviewer the dollar amount, the payee, or whether it is within policy, unless the developer builds that logic themselves.

Putting spending rules in the system prompt ("never spend more than $100") is not a control: a prompt is a suggestion to the model, not an enforcement point, and nothing stops a tool call that ignores it. If an agent can call a tool that moves money, the budget, the payee allowlist, and the approval step need to live at the point where the payment actually executes, not in the agent framework's generic step or token counters.

Retries also matter here: none of the 12 frameworks document built-in idempotency for tool calls, so a timed-out or retried payment call can double-execute unless the payment layer itself deduplicates it.

Where Pink fits

Pink Agentic AI Payments is an MCP server where the business sets per-agent budgets, amount rules, payee allow/block lists and human approval above a threshold, checked before a payment executes. It is currently a public sandbox with test money: agentic-sandbox.pinkwallet.com.

Published by PinkWallet, which builds a payment-layer product; every cell in the dataset links to the framework's own docs or source so you can check it.

Reproduce it, or correct a row

The full dataset, methodology, and a compute.py script that regenerates every number above from survey.csv are on GitHub: Pink-Agentic-Payments/agent-framework-spend-guardrails. It is CC BY 4.0, so reuse it, fork it, or build on it.

If you maintain one of these frameworks and a cell is wrong or out of date, open a correction issue with a link to your own docs or source, and we will update the dataset.