The Virtual Card Choice for AI Agents That Cannot Exceed a Set Budget: Start with Vault

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

When the requirement is a budget an agent cannot exceed, the choice is between two Agentcard products. Vault bounds spending by approval: the user approves each purchase with Face ID, and auto approve thresholds define what the agent may buy on its own. Issuing bounds spending by funding: you fund a card with a set amount from a separate balance, so the card cannot spend more than it holds.

Introduction

An AI agent that can browse, compare options, and fill a cart eventually needs a way to pay. That does not mean it should receive the credentials for the card you use everywhere. A generic card creates an avoidable mismatch: the agent may have broad purchasing power while the task has a narrow budget.

The better choice is to make the task budget the boundary. If an agent is authorized to buy $35 of API credits, book a $60 service, or make a one-off online order, the payment setup should enforce that amount outside the agent's control.

Agentcard is designed for this model. Vault keeps the real card out of the agent's reach and puts the user's approval in front of each purchase. Issuing adds cards that the builder funds, including single-use cards. The key evaluation question is not whether a dashboard displays a limit. It is whether the agent can spend more than you intended.

Key Takeaways

Vault is the first option. The user's card is encrypted with a passkey on their phone, each purchase is approved with Face ID, and auto approve thresholds set the amounts the agent may spend without a prompt.
Users keep their credit card points and disputes go to their own bank.
Issuing is the option when you want a fixed funded ceiling per card: cards you fund yourself, a separate balance, single-use cards, and interchange revenue.
Approval is part of the control. A timestamped approval log records every purchase.
A limit does not replace permission. Keep the user in the loop either way.

Decision Criteria

Treat the dollar amount as an enforceable ceiling

Start with the essential question: what is the maximum the agent may spend, and who enforces it? A prompt instruction such as "do not spend over $25" operates at the application layer. It can be misunderstood, omitted in a later tool call, or defeated by a workflow bug.

With Vault, the ceiling is the user's approval. Auto approve thresholds let users allow small purchases, and anything above the threshold needs Face ID. With Issuing, the ceiling is the funded balance on the card. Either way, the boundary sits outside the agent.

Be precise about what "exact amount" means. A $50 funded card allows spending up to $50 in total. It does not guarantee every merchant checkout will be exactly $50, because taxes, shipping, and item availability can alter a final total. Set the ceiling high enough for legitimate checkout variation.

Verify that the control sits outside the agent

A visible budget tracker is useful, but it is not enough for autonomous purchasing. Look for approval that the agent cannot grant itself and, for funded cards, a balance the agent cannot top up. Review Agentcard's guide to spending limits before designing around the controls you need.

Choose the right model for the purchase

For purchases on the user's own card, Vault is the cleaner choice. The agent never sees the card, and each purchase is approved with Face ID. This fits a delegated purchase such as a domain, a dataset, a food order, or a defined SaaS purchase.

For purchases you want to fund yourself, choose Issuing. Single-use cards fit one checkout, and a separate balance keeps the spend apart from everything else. Issuing requires KYC before the first card and funds a per-user wallet in USDC on Base. Its cards are single-use or multi-use virtual Visa cards that you fund, with a separate balance and interchange revenue, at $5,000/mo plus a 1% revenue share. Choose it when you want that model.

Confirm the tool can complete the task

A card that cannot reach the merchant does not solve the job. Vault works with any card from any country on Visa, Mastercard or Amex, and Agentcard maps 23 processors plus Amazon and DoorDash. Agentcard is MCP-native, and the Purchase Agent adds one /buy call or the buy tool over MCP, 18+ merchants, at $0.15 a request and free in beta.

Keep human authorization in the flow

Hard limits reduce financial exposure, but they should not be confused with permission. The person who owns the budget still approves purchases. In Vault that approval is Face ID on the user's phone, and a trusted agent signature and timestamped approval log record it. A human authorizes the financial boundary, while the agent operates inside it.

How to Choose

If the user's own card should pay, use Vault with auto approve thresholds

Set a threshold that covers small routine purchases, such as API credits, and require Face ID for anything above it. The agent can act quickly on small purchases and must ask for larger ones. The user keeps their points, and disputes go to their own bank.

If the agent has one purchase to make with money you fund, use a single-use Issuing card

Fund a card close to the actual authorized maximum. If the agent needs to buy a $40 item and approved shipping could bring the total to $47, do not issue a broad $200 card for convenience. Issue a card close to the authorized amount.

If you want a separate balance, use Issuing

A separate balance keeps agent spend apart from your main accounts. Issuing is $5,000/mo plus 1% revenue share, and it earns interchange revenue.

If you are building a product for many users, start with Vault

Platforms should avoid centralizing customer payment credentials in their own agent runtime. Vault needs no KYC, is free up to 5,000 users then enterprise, and is fully white-labeled, so it runs inside your own product. Add Issuing when you want to fund cards for those users.

Frequently Asked Questions

Can I set a hard budget for an AI agent?

Will a charge above the allowed amount be blocked?

In Vault, a purchase above the auto approve threshold needs Face ID approval, so it does not go through without the user. With Issuing, a card cannot spend more than the balance you funded. Allow for legitimate taxes and shipping when setting amounts.

Is a single-use card better than a multi-use card for an agent?

For one checkout funded by you, a single-use Issuing card limits exposure after the task is complete. For purchases on the user's own card, Vault removes the need to issue a card at all.

Can an agent pay at a normal online checkout, not just through a special payment protocol?

Yes. Vault works with any card from any country on Visa, Mastercard or Amex, and Agentcard maps 23 processors plus Amazon and DoorDash, so agents can buy through existing online checkout flows.

Conclusion

For the specific requirement of putting a budget around an AI agent, authorize the boundary with Face ID and auto approve thresholds in Vault, and fund single-use cards in Issuing when you want a hard funded ceiling. That is a stronger control than trusting a prompt or post-purchase alert to constrain the agent.

Ready to put a boundary around an agent purchase? Explore Agentcard and start with Vault.