- AWS describes AI agents paying for model calls one request at a time, with spending caps enforced by infrastructure rather than by the model.
- The point for executives: when software becomes a buyer, the key control is a limit the agent's prompt cannot change.
- Ask who sets each agent's ceiling and who owns its wallet. The figures are AWS's and its partner's own; the payment count comes from a beta.
The buyer nobody approves
Software is starting to spend money on its own. Picture an agent working through a task. Along the way it pays for things: an answer from a model, data from an API, a web page, even help from another agent. AWS notes the amounts can be a fraction of a cent, and nobody is there to approve each one.
That changes what a security control has to do. For decades, spending limits protected organisations from people. Now the spender is a program that reads text, and text can be manipulated. The lesson here is that the control that matters most is the one the agent cannot argue with.
What AWS reported
In an October 8 post, AWS describes how Incarna, a company built by SpreadX, lets its agents pay BlockRun for AI model calls. BlockRun is the seller. Its catalog holds over 90 models, spread across more than 15 providers, and agents reach them through one metered endpoint. Each call is quoted and settled on its own, using a payment protocol called x402.
Incarna used Amazon Bedrock AgentCore payments, a managed AWS service that handles the protocol, connects to a wallet, signs each transaction and enforces spending limits. AWS says Incarna finished the integration in three days, against two to three months originally scoped.
How one purchase works
The mechanism builds on an old web status code. HTTP 402, "Payment Required," is a code reserved for payments. Here, the x402 protocol puts it to work.
The agent asks BlockRun for a model call. BlockRun replies with a 402 and a price for that specific call. The agent opens a payment session and asks AgentCore payments to process the payment. The service checks the quote against the session's spending limits and signs the authorization from the agent's wallet. BlockRun verifies the signature, serves the answer and records the charge.
AWS says two pricing schemes exist. With "exact," the price is known up front. With "upto," the agent approves a ceiling and the provider settles for actual usage, up to that amount. Payments settle in USDC, a dollar-linked stablecoin, on the Base network, so each one can be checked on-chain.
Why the cap sits outside the model
Each payment session carries a maximum spend and an expiry time. AWS says the service enforces the ceiling at the infrastructure layer, so the agent's own code and prompt cannot change it. It adds that an agent cannot overspend even if its prompt is manipulated. Incarna sizes its sessions to a day's budget.
Think of a company card. The limit is set by the issuer, not by the cardholder's good judgment. Nobody relies on an employee promising to stay under budget. The same logic now applies to a program that can be talked into things.
Identity matters too. AWS says the customer owns the wallet and grants Incarna delegated permission to use it. The on-chain payer is the agent's own identity, not a shared platform key. So each transaction traces to one agent rather than disappearing into a pooled account.
What the post does not show
This is AWS's account of a partner's work. The figures are AWS's and its partner's own; the payment count comes from a beta. It is one integration, not evidence of a wider shift.
The post also does not say what happens when an agent hits its ceiling mid-task, or how often that occurs. It reports no incidents and no losses. Those are the details a risk owner would want first.
Questions to put to your teams
If any team is building agents that buy services, ask five things. Who sets each agent's spending ceiling, and is it enforced outside the model? Who owns the wallet, and how is access revoked? How large is one session's budget, and why that size? Can every payment be traced to a single agent identity? What does the agent do when the limit is reached?
An agent that can spend is a new kind of employee with no judgment of its own. The sound design gives it a budget it cannot raise.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: AWS.
