# Agent Spending Without Controls Rodrigo Coelho & Pranav Maheshwari, Edge & Node | AI Engineer World's Fair 2026 | 20:48 Source: https://www.youtube.com/watch?v=ZyGMqdIpPoE Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/agent-spending-without-controls Published: 2026-09-01 Tags: enterprise, guardrails, mcp, tool-use ## TL;DR - Agents need payment access to paid MCP tools if they are going to handle tasks that free tools cannot complete. - Enterprise adoption requires a compliance layer because agents transact at machine speed through wallets with no identity attached. - Wallet screening can allow a good agent's payment while rejecting a sanctioned wallet's transaction. ## Summary Rodrigo Coelho and Pranav Maheshwari argue that agentic commerce needs two pieces of infrastructure: a way for agents to pay for useful tools and controls that prevent unsafe transactions. Coelho gives the history, including Edge & Node's query micropayment work for The Graph in 2021 and its later collaboration on x402. Maheshwari then demonstrates the difference between an agent with an Ampersend skill file and one without it. The agent with access to paid MCP tools finds a specific Mastercard contact, while the other returns only an email format. A second demo lets an agent buy a Father's Day gift under a spending limit. The final demo shows why payment alone is insufficient for enterprises. With screening disabled, both an ordinary wallet and a simulated sanctioned wallet pay for a scraping service. With TRM screening enabled, the sanctioned transaction is rejected. ## Key ideas ### Edge & Node had query micropayments before x402 was released [00:01](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=1s) Rodrigo Coelho says Edge & Node built The Graph, a blockchain data indexing protocol that has served 1.8 trillion onchain queries since 2018. The company developed a micropayment system for queries in 2021 and referenced the HTTP 402 specification in a blog post. In late 2024, the team studied how agents could pay for Graph queries. A few weeks later, Coinbase released x402, and Edge & Node began working with Coinbase and Google on the specification. The company joined the foundation and contributed prior work on micropayments and batching to reduce gas fees for very small payments. ### Traditional payment rails assume a human can make the decision [03:33](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=213s) Coelho says financial institutions built traditional payment rails around a human in the loop who decides whether a payment should pass. Agents transact at machine speed and can run around the clock, so policies designed for people do not fit their operating pattern. He describes the current stage as early, with experimentation around retail payments and infrastructure work ahead of broader enterprise use. Ampersend is presented as a financial harness for agentic checkouts, with controls that sit around the agent's spending rather than relying on a person to approve every transaction. ### Enterprise adoption depends on identifying the wallet's owner and purpose [04:49](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=289s) Coelho says a compliance layer must answer questions about the counterparty. It needs to establish whether the entity is sanctioned, whether it has been involved in terrorist activity, and who is behind the wallet. An agentic transaction may present only a wallet address, without the background information that financial institutions expect. He says these systems already exist in the traditional financial world, but they need to be adapted for agents before large enterprises approve the technology. The buyer and seller both need controls that make the transaction acceptable. ### A legal or policy officer remains responsible for the agent's actions [05:58](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=358s) Coelho says an enterprise will still have a human responsible for approving its agentic payment system, such as a chief legal officer or chief policy officer. That person must be confident that agents cannot hallucinate, overspend, go off the rails, or break company policy. He points to fines in the tens, hundreds, and even billions of dollars as a reason for caution in financial services. His view is that governance has not caught up with the speed and autonomy of agent transactions, so the infrastructure has to include spending and policy controls before enterprises can sign off. ### An agent with paid MCP access can complete tasks that a free-tool agent cannot [07:43](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=463s) Pranav Maheshwari says agents need tools to become useful beyond coding. Many MCP servers are currently free, but he expects important services to charge in the future. He compares two terminals running the same request: find the email information for the head of crypto and blockchain at Mastercard. The terminal without the Ampersend skill file returns the company's email format and suggests working out the address separately. The terminal with the skill file uses a paid endpoint and returns the specific email, the person's Twitter handle, and their location. Maheshwari says the payment happens in the background through the agent's wallet. ### A wallet lets an agent buy within a user-defined limit [12:16](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=736s) Maheshwari demonstrates a second use case with Shopify UCP. He instructs the agent to buy his father a Father's Day gift for less than $10. The agent searches shops, finds possible gifts, and completes a checkout through the Ampersend wallet. Maheshwari says the agent already knows his name, address, phone number, and preferences, so he does not have to enter those details during the transaction. The demo shows a total of $9, followed by an authorized transaction for the order and a receipt. He later shows that the order was placed and could be tracked from the agent terminal. ### Wallet screening changes a payment from authorized to rejected [16:14](https://www.youtube.com/watch?v=ZyGMqdIpPoE&t=974s) The final demo uses a scraping service that charges 0.1 cent for access to website data. Maheshwari sets up a good claw with an ordinary wallet and a bad claw using a simulated sanctioned wallet. With screening disabled, both transactions are authorized. He then enables a compliance feature built with TRM, which scans the wallet and checks the transaction. The good claw continues to work, while the bad claw's payment is blocked and rejected. The rejection identifies the reason as a blocklisted wallet address. The demonstration makes the compliance requirement concrete on both sides of an agentic transaction. ## Notable quotes - "Traditional payment rails though were built for humans." (03:18) - "The reason is that most important MCP servers are going to be paid and you'll not put in your credit card to all these MCP servers." (08:54) - "Your agent is as powerful as the paid MCP tools that you're connected to it and if you've given it a payment trail." (12:56) - "Right now because we don't have regulations both these transactions are going through." (17:48) - "And the reason behind the denying is because you're in the block listed wallet addresses." (18:33) ## Tools & references mentioned - The Graph - Edge & Node - Ampersend - x402 - Coinbase - Google - Circle - Nano Payments - OpenClaw - MCP - Cloud Code - Exa - Firecrawl - Shopify UCP - Amazon - Cloudflare - TRM ## Who should watch - You are building agents that need paid APIs or MCP servers and want the payment to happen without putting a card into every service. - You work on enterprise payments, financial services, or agent governance and need to understand why a wallet address is not enough for approval. - You are evaluating agentic checkout flows and want to see how spending limits and sanctioned-wallet screening behave in a live demo.