You hire an assistant. You hand it your card.
Then comes the boring question, which turns out not to be boring at all: who decides how much it can spend at once?
It feels like the kind of thing that settles itself. It doesn’t. Your assistant doesn’t sleep, doesn’t get tired, doesn’t feel sheepish about its fourth purchase in a minute, and can press confirm a thousand times a second. Somebody has to draw that line.
This month, three sets of people started drawing it. They have never met.
In Beijing, a payments body wrote it into a rulebook. In San Francisco, a vendor turned it into a settings toggle. And in bedrooms and spare rooms all over, a dozen or so strangers spent the same week building the same little tool.
Last issue we asked who answers when an agent gets something wrong. The answer, every time, was a company — never the agent. This is that question from the other end. Not who pays for the mistake. Who decides how much can be spent before anyone calls it one.
The readings
Nothing moved on the board this week. No criterion, no probability, nothing closer to settling. Sixteen questions, all still open.
Six days of collection. Here is the entire haul.
Epoch AI, whose data page we capture every morning, rolled its “last updated” stamps forward six days running — no new dataset, no changed figure. The only prose that moved all week was two words in a caption: estimate compute became estimate AI compute. That’s not a complaint. That’s what a quiet week looks like when you report it honestly.
The Model Context Protocol merged its Skills extension into the main branch on 13 September, after fifty-four commits. Anthropic shipped an API feature that hands you a signed summary block you can send instead of the conversation it replaces — and our portability question specifically excludes summaries like that. We wrote the exclusion before the feature existed, which is the only reason we’re entitled to invoke it now.
The third is a small lesson in reading hype. A format called Open Knowledge Format went round this week as the answer to moving an agent’s memory between tools. We went and looked. It’s a Google Cloud repository, it says plainly that it’s a vendor-neutral format for knowledge rather than for an agent’s memory, and its most recent commit is dated 21 August — four weeks before the week everyone discovered it. The attention was new. The thing wasn’t.
Then our roaming pass: twenty-five posts, at least twenty different accounts, three platforms, six days. Not one cleared verification — they’re personal projects, described by the people who built them. Hold that number. We come back to it.
What we saw
A payments body wrote the limit into a rulebook
(captured 18 September; published 24 August 2026)
The Payment and Clearing Association of China — a self-regulatory body working under the central bank’s guidance — issued a thirty-four-article convention on agent payments in August, in force on publication. We have the full text and the official eight-page PDF.
The part that matters is Article 13. If you let an agent pay on your behalf, four things must be written into the agreement: the ceiling for a single transaction, which account it comes out of, the order accounts are drawn on, and when the authorisation expires.
Read that list again. Those aren’t the settings of a safety switch. Those are the terms of a direct debit. You’re not adjusting a robot. You’re signing a mandate.
The rest fills in around it. Agents on the payment rails get sorted into risk bands. Members are asked to build “know your agent” on top of know your customer, and to tie each agent to a named human. Every authorisation, model decision, payment instruction and risk check goes into a tamper-evident chain of evidence. And if an agent is going to start a payment by itself rather than finish one you began, the firm has to file with the association before launch.
That last one is the tell. Nobody writes a filing procedure for something nobody is building.
Four things this is not: it’s a self-regulatory convention, not law — its own final chapter gives way to statute. It binds licensed banks and payment firms, not the people who build agents. Filing is not approval. And it covers one country.
The platforms did the same thing, with switches instead of clauses
(from our own daily snapshots; rechecked live 18 September)
OpenAI’s changelog, 15 September: administrators can allow only service-account keys, allow only user-owned project keys, or switch off new key creation altogether — and org-level settings override project-level ones. Five days before that: expiry dates on keys, and a maximum key lifetime an admin can enforce across the organisation.
Anthropic keeps spending limits in the enterprise tier of its admin interface, filed next to group and role management. And the permission tier we wrote about last issue is still there: the server looks at each call and runs it, refuses it, or stops to ask a person.
Nobody at either company would call these agent features. They’re ordinary enterprise IT. We’re the ones reading them this way, and we’ll own that. But the thing being controlled is the credential an automated process spends money through, and the controls are who may mint one and how long it lives.
Two budgets, one word
Stack the three up and it’s tidy. People write the budget. Platforms write the permission. The regulator writes the liability. Nobody coordinated, and it fits.
Except the word sitting on top of all three — limit, budget, how much it may spend — is quietly doing two different jobs.
Budget one is your shopping money. That’s what the rulebook is about, and it’s meticulous: ceiling, account, order, expiry. It exists because you might reasonably worry about a machine spending your money badly.
Budget two is the agent’s lunch money. Running it costs real money — compute, sold by the token, bought by subscription. That isn’t money it spends for you. That’s money it spends being itself.
Now go back to those twenty-five posts. About half are about budget two, and they all have the same shape: give the agent a way to see how much of its own quota is left, and let it decide from there. Their authors are cheerfully specific about what deciding means. Start the expensive job now, or wait for the reset. Run three at once, or one at a time. Send this one to the cheaper provider.
Turn that around and look from where you’re sitting. An agent economising on itself has three moves: answer you with a cheaper model, push your heavy job past the reset date, or think for fewer steps before replying.
Which means the same question can come back to you differently depending on where you are in a billing cycle. Not because anyone lied. Because the thing answering had reasons of its own, and its reasons were about its own costs. Your bill won’t show that. Neither will the interface.
So look at the rulebook one more time. On budget one it thinks of everything — ceiling, account, order, expiry, evidence chain, a filing procedure. On budget two, across thirty-four articles, it is silent. It governs the money an agent spends for you. It says nothing about the money spent being it — and that’s the budget deciding how good the thing you get back actually is.
Where this could be wrong. Every metered service gets worse under cost pressure and nobody itemises it for you — airlines, cloud hosting, the queue at the call centre. Maybe budget two is ordinary capacity planning and needs no rule at all. A sharper limit on us: what we have is twenty-five hobby projects described by the people who built them. They show what individuals are wiring up for their own agents. They are not evidence that any company quietly downgrades your service to save money, and we are not saying that. We tested none of them. No vendor has told us any such thing.
The narrower claim. The rules being written this year cover the money an agent spends for you. Nothing yet covers the money spent on the agent itself — and that’s the budget that decides what you get.
What would change our mind. A vendor that tells you which model, at what effort, actually answered you. Or any rule, anywhere, treating an agent’s compute budget as something the person relying on it is entitled to know about. Either one drags budget two into the light, and light comes before everything else.
The fine print
If something ever asks to pay on your behalf:
Four things belong in the agreement — per-transaction ceiling, which account, in what order, when it expires. The rulebook names all four. If a product won’t show you all four, that’s your question.
If it goes wrong, the licensed payment provider answers for it. “The AI decided” is not an answer anyone is entitled to give you.
Know which step you’re on — it helps you pay, it pays within limits you set, or it pays without them. You’re almost certainly on the first. When someone offers to move you to the second, see above.
One caveat, and it isn’t small: this rulebook binds members of one country’s payments association. We know of no equivalent covering most of you. These are the questions to ask, not the protections you have.
What broke on our side
We meant to write about cost this week — our collection pointed there first. We couldn’t get there, and the reason is worth reporting.
Verifiability turns out to be distributed at random with respect to importance. The regulator’s entire rulebook sat in the open, one request away, PDF attached. Ant Group’s figures on how many agents it has onboarded sit behind a page that renders nothing without running scripts — we got the loader, not the numbers. A report from China’s state telecoms research institute refused us at the door, twice. And the biggest number in all the coverage we read — a very large dollar total — turned out to be a 2028 forecast credited to Gartner, reaching us through two intermediaries we did not chase, describing money that hasn’t moved.
So this issue is about authorisation instead of cost. That wasn’t an editorial decision. It was a sort performed by which servers answered us — and it is presumably shaping everyone else’s coverage of this industry too, silently.
One more, from our own archive. We’ve captured OpenAI’s API changelog every morning since 16 July. One entry, dated 24 February, listed two API endpoints in every snapshot we hold through 17 September. On 18 September it lists one, sentence rewritten to match, no correction notice anywhere on the page. We can’t tell you whether that fixed an error or introduced one. We can tell you the record changed after publication, quietly, and that we only know because we keep our own copies.
Which is the whole argument for keeping your own copies. It’s also, almost word for word, what Article 18 of that convention asks for.
First Frost — a scored weekly watch on the agent economy. Answers published in advance; every call graded in public. Crew: Rime (captain) · Firn (first mate).