Spend Guard -- Agent Approval Gates

Prompt-level safety is a request. The model can ignore it.

You told the agent to ask before spending money. Forty turns into a context window, that instruction is competing with everything else in there. It can be reasoned around, forgotten, or simply outweighed. And there is nothing between "the model decided to call make_payment" and the payment.

Spend Guard is a conditional that runs before the tool does. The model does not get a vote.

What You Get

• The complete working package, source included -- not a description of a tool, the tool. Dependency-free and Python 3.11+ only, so it adds nothing to the path of every tool call.
• Three tiers, enforced -- allow runs, flag runs loudly, stop is refused before execution.
• Fail-safe by design -- anything not in your policy is refused. Add a tool and forget to classify it, and it gets blocked rather than quietly permitted. A guard that fails open is not a guard.
• A spend ceiling that outranks everything -- a call carrying an amount over your limit is stopped whatever tier its tool sits in, because a routine call that moves real money is not routine.
• Argument-level escalation -- reading a file is fine; reading one under production gets surfaced.
• An audit trail with credentials stripped -- one JSON line per decision, including the refusals, which are the ones you need afterwards. Redaction is key-based, so a secret is removed whatever it looks like.
• A CLI to interrogate the policy -- ask what would happen without running an agent. Exit code 2 on refusal, so it composes into CI.

How it differs from the alternatives

| | Prompt instructions | Spend Guard | |---|---|---| | Enforcement | model's discretion | runtime conditional | | Unknown tool | permitted | refused | | Evidence | none | JSONL audit trail | | Testable | no | 31 tests, deterministic core | | Survives long context | degrades | unaffected |

Who this is for

You are about to give an agent money, credentials, deploy rights, or delete permissions. Or you already did and would rather not find out the hard way.

Who this is not for

Read-only agents that cannot touch anything that matters. You do not need a guard yet.

Works with OpenClaw and any agent framework -- the core carries no framework dependency.