Give an AI agent a wallet and it can finally do the thing everyone wanted: hit a paywall at 2 a.m., pay it, and keep working while you sleep.
Now give that same agent a bug. A retry loop. A vague instruction it interprets generously. The wallet does not care why it is being asked to pay. It pays.
Most answers to this problem live in the wrong place. A policy file the agent can read, and potentially argue with. A wallet allowance you set once and forget. What you actually want is a limit enforced by the platform the agent is spending on, decided before any money moves, with proof that the limit fired.
That is the control Zambo shipped with its agent payments: spend limits, enforced by Zambo itself. I tested the strictest version of it today, live: a cap of zero dollars.
The setup
Zambo lets an agent pay for its own Day Pass: $0.99 in USDC on Base, through x402, for 24 hours of access. The payment challenge the server returns says the quiet part out loud:
Agents may pay the $0.99 USDC Day Pass (x402 on Base, 24 hours) directly. No human approval is required by Zambo. Your own wallet or spending policy still applies.
No human approval is the feature. It is also why the limit matters. Two new tools carry it: spend_limit_set puts a daily cap, plus an optional monthly cap, on a work connection. spend_limit_status reads back what was spent, what is pending, and what is left. Both are free to call.
The live test
On a fresh work connection, I set the cap to zero:
spend_limit_set { daily_usd: 0 }
-> limit: 0
Receipt for the setting itself: https://zambo.dev/run/cd20cce4-a2d5-4af4-8230-3ba5352dc4ba
A status read confirmed the state of the connection: spent today 0, pending 0, limit 0, remaining 0.
Then the agent tried to buy its Day Pass anyway. The first call returns the standard x402 challenge: version 2, exact scheme, Base network, 990000 atomic units (that is the $0.99), payable to the Zambo address. A challenge is just an invoice. The real test is what happens when the agent answers it with a payment envelope, the way an agent paying on its own would.
Zambo refused it:
error: spend_limit_reached
limit usd: 0
No settlement was attempted. To be extra careful, the test payment was presented from a fresh key holding no funds at all, but at a $0 cap that turned out to be belt and suspenders: the refusal happens at the cap check, before settlement is even on the table. I read the status again afterwards. Spent today: still 0. Charges: none. Nothing moved.
And the refusal is not a log line you have to take on faith. It has its own verifiable receipt: https://zambo.dev/run/2f8bd3d1-8485-441d-8e4e-bad587b984d3
Open it and check it the way you would check any Zambo receipt. The public verification for that receipt reports the saved result matches its recorded SHA-256 commitment. In plain terms: the record of the refusal you are looking at is the record the run produced, unchanged since it was saved.
How you would actually use it
Zero is the test setting. The working setting is a number like $5 a day: enough for the agent to buy its Day Pass and cover metered charges while it works, small enough that a loop cannot hurt you. When the agent reaches the cap, the next payment gets the same refusal I got, and spend_limit_status shows you exactly what was spent, what is pending, and what remains, charge by charge. Raise the cap when you mean it. Lower it when you do not.
The limit lives on the connection, not inside the agent's instructions, so the agent cannot talk its way past it, misread it, or forget it exists. Every state of it, the set, the status, even the refusal, leaves a receipt.
The buying questions, answered straight
What does Zambo cost? Every tool has a free tier to start. A Day Pass is $0.99, one time, for 24 hours. The Zambo Pass is $29 a month or $290 a year, and $19 a month for $ZAMBO holders. The full ladder is on the pricing page: https://zambo.dev/pricing/
Is the Day Pass a subscription? No. It is one payment for 24 hours. It never renews and never auto-charges. When the 24 hours end, access simply falls back to the free tier. There is nothing to cancel.
How do agents pay, and how do people pay? Agents pay in USDC on Base through x402, the flow tested above. People pay by card through PayPal on the Day Pass page: https://zambo.dev/day-pass/
Does my agent need my permission to pay? Zambo does not ask for it. That is deliberate, and it is exactly why the spend limit exists: your permission takes the form of a cap you set in advance, enforced before money moves, plus whatever policy your own wallet enforces.
What does a receipt prove? A verifiable receipt shows the saved output has not changed since it was recorded. It does not prove the output was correct. The receipt format, AER-1 (IETF Internet-Draft draft-zambo-aer1-20), has no issuer authentication: a receipt proves the record is intact, not who produced it. Anything in this article that rests on a receipt rests on exactly that, no more.
Try it
Connect your AI once at https://zambo.dev/mcp, or watch it work first in the free demo: https://zambo.dev/demo/
Then tell your agent to set its own daily cap before it spends anything. If it argues, remind it who holds the wallet.
Receipts run on AER-1, the open format for AI execution receipts: https://datatracker.ietf.org/doc/draft-zambo-aer1/20/
Your AI said "done." For $0.99, prove it: https://zambo.dev/day-pass/
The Day Pass is one time. It never renews.
Top comments (0)