Agent budget audit ABA-1 with signed receipt

required; the budget the principal intends for one period

length of the period, default 30

maximum per single action, if one is enforced

everything the agent's credentials can reach: balances, card limit, credit line, auto-reload ceiling

the fastest the agent could technically spend

hours until a human or an independent monitor would notice abnormal spend

optional; what achieving the goal is worth to the principal

optional; probability of achieving it, 0 to 1

measured, estimated or unknown

comma list of compute, payments, commerce, ops; default all

agent or principal

optional name or address of the audited agent, echoed in the receipt

yes, partial, no or unknown. Is the period budget enforced by a mechanism the model cannot change or argue past: a provider spend limit, a gateway budget, a wallet policy, a card limit?

yes, partial, no or unknown. Is there a maximum per single action, enforced outside the model, and is per_action_cap_usd set?

yes, partial, no or unknown. Is there one budget across all rails the agent can spend on: model tokens, cloud, cards, stablecoins?

yes, partial, no or unknown. Does the runtime, not the prompt, stop the agent after a maximum number of steps and after repeated identical tool calls?

yes, partial, no or unknown. Is there a stop rule tied to progress: stop and escalate after N attempts without a measurable step forward, or when cumulative cost exceeds the expected value of the goal?

yes, partial, no or unknown. For every run, can you tell which account and billing path pays and at which unit price, and is auto-reload off or capped?

yes, partial, no or unknown. Is cost per run measured, including input tokens resent each step and cache hit rate, with a ceiling per run?

yes, partial, no or unknown. Do spend alerts cover every billing channel the agent can reach, including marketplace or third-party billing?

yes, partial, no or unknown. Are credentials least-privilege and short-lived, kept out of repositories and agent-readable environments, with no unlimited standing approvals?

yes, partial, no or unknown. Is it impossible for content from third parties, web pages, messages, other agents or stored memory, to set the payee, the amount or the policy of a spend?

yes, partial, no or unknown. Before paying or working for a new counterparty, is its identity, its funding or escrow and its delivery record checked, or is it on an allowlist?

yes, partial, no or unknown. Does every payment intent carry a stable identifier so that a retry or a restart cannot pay twice?

yes, partial, no or unknown. Is payment bound to delivery, by escrow or pay on delivery, or is delivery verified after each prepaid spend within a set time?

yes, partial, no or unknown. Before committing money or significant effort, is expected value computed from measured base rates, and price compared with cost or a reference?

yes, partial, no or unknown. Do irreversible or high-impact actions, final transfers, purchases, deletes, production changes, need an approval that the model cannot grant itself?

yes, partial, no or unknown. Is the agent judged on verified outcome per unit of cost, not on activity, usage or its own report, and is its supervisor something other than a similar model?

yes, partial, no or unknown. Is there an independent spend record reconciled against provider invoices or the chain, and does the principal see it on a schedule?

yes, partial, no or unknown. Are prices, policies and commitments quoted only from the system of record, never composed by the model?