Budgets for AI agents

A verified signature tells you which operator is calling. It says nothing about how many free trials they may take, so you set an hourly and a daily cap per operator.

Decision trace

Setting budgets

Set hourly and daily caps for each verified operator. Use a default for other verified operators, or a separate opt-in bucket for valid but unknown signers. Inspect today's operator counts in settings. Atomic per-site counters enforce the edge even when requests arrive together.

Limits

• Only signed/IP-verified agents are budgeted. Unsigned browser agents fall under normal scoring.
• A signature proves an operator identity. It proves no human identity and grants no permission. Per-end-user caps require separate account/device protections.
• Budgets count successful token verifications, which is not the same as completed signups. There are no built-in recommended caps; the example is illustrative.
• Hour and day windows reset on UTC boundaries and are not rolling intervals. Observe mode records without enforcing.
• Your backend must apply the returned decision. A block policy or existing block verdict remains blocked.