Guardrails for personal agents that can spend money

A personal agent that can spend money needs five guardrails: a hard spending ceiling written into every task, human approval before payment, a payment method that can only be used once, the narrowest possible access to accounts, and a log you actually read. Muse ships with some of these: purchases need your approval, and Stripe Link issues single-use virtual cards. The rest are up to you to set.

What Muse already does

From Meta's security write-up:

• All purchases requiring payment go through human approval.
• Checkout pages using saved payment credentials require approval with the purchase details.
• The Sentinel authority can allow, deny or ask on every connector action and every outbound network request.
• The agent works with surrogate credentials, so it never holds your real passwords.

From Stripe: at more than 1M Link merchants Muse checks out with your saved method, and elsewhere Link issues a single-use virtual card scoped to the purchase. Shop Pay and PayPal checkout were added September 21–22.

On Mac, Meta says Muse asks before sending email or making purchases, and deleted files go to the trash (Meta help).

That's a solid base. It doesn't stop a mistake you approve without reading, and it doesn't cover custom connectors or scripts you give the agent.

Guardrail 1: Put a number in every money task

The best result in our catalog came from a ceiling, not a vague goal. Chandra Bhavanasi told Muse to accept any AT&T fiber offer under $70/month, and it landed $40/month plus 3 months free.

Write money tasks like this:

• Maximum: "Spend no more than $120 total, including fees and tax."
• Acceptable outcomes: "Accept a credit, refund or rebooking. Don't accept vouchers that expire in under 12 months."
• Stop rule: "If the price changes at checkout, stop and ask."

Guardrail 2: Read the approval, don't just tap it

Approval prompts only protect you if you read them. Check the merchant, the total and the recurrence. A monthly subscription at $9.99 looks the same as a one-off at a glance. Approval fatigue is a real risk once an agent is useful, so keep money tasks rare enough that each approval gets attention.

Guardrail 3: Use payment methods that limit damage

• Prefer Link's single-use virtual cards over saved cards where you can.
• Keep a separate card with a low limit for agent purchases.
• Turn on your bank's real-time transaction alerts.

The receipt audit that found a forgotten $100/month subscription is a reminder that recurring charges are where money leaks.

Guardrail 4: Give the least access that works

• Set connectors to read-only unless the task needs writes (Meta help).
• On Mac, set each app to Off, Read only, or Read and interact, one at a time.
• Remember that custom connectors aren't reviewed by Meta. Read what a custom connector can do before you connect a financial account to it.
• Plaid's connector covers 12,000+ US institutions (Plaid). Reading balances is a different risk level from moving money. Know which one you're enabling.

For your own services, scope credentials:

• Muse Proxy stores CalDAV/CardDAV credentials once and hands Muse scoped API keys.
• 1Claw's connector uses scoped, revocable connector tokens for agent wallets and approval queues.
• The homelab setup SSHes into a restricted user.

Guardrail 5: Add policy checks for business payments

If the agent handles vendor payments, don't rely on a chat prompt. Change Verifier runs seven checks on bank-account or payee changes, returns clear, review or block, and holds the change until a named owner accepts it. Payee-change fraud is exactly the kind of attack an injected email would try.

For Muse Code, the Agentic Control Plane plugin checks every tool call against a policy before it runs and logs allow, ask or deny with a reason. Maestro adds a command guardrail and secret redaction.

Guardrail 6: Keep a log and review it

Two-phase writes and audit logs, as in muse-fileapi, make mistakes recoverable. For the personal agent, review completed tasks weekly: what it bought, what it signed up for, what it sent. TerMuse lets you watch the agent's machine live while you're building trust.

Guardrail 7: Plan the human handoff

Some steps should stop for you. When the Xfinity phone agent hit a verification text it couldn't read, it patched the user into the call instead of guessing. That's the behavior you want: when identity or money is uncertain, escalate.

Guardrail 8: Know which merchants don't want agents

Amazon blocked Muse purchases from September 20, saying the agent didn't identify itself and appeared to store credentials (GeekWire). Workarounds like a cart-only Amazon API stop short of checkout. Don't script an agent into a store that has told agents to stay out; it can put your account at risk.

A guardrail template you can paste

Task: [goal]. Budget: no more than $[X] total including tax and fees. Acceptable: [list]. Not acceptable: [list]. Do not start subscriptions or auto-renewals. If the price, merchant or terms change, or you need a verification code, stop and ask me. When done, list every charge with merchant, amount and whether it recurs.

Where this still breaks

Guardrails reduce risk, not to zero. Meta says prompt injection "remains an open problem" and that Muse "will sometimes make mistakes." A malicious page or email can still try to steer the agent inside your limits. Read prompt injection for browsing and buying agents next, and Muse security and privacy for the full architecture.

Frequently asked questions

Can Muse buy things without my permission?

Meta says all purchases requiring payment need human approval, including checkouts with saved payment credentials. Read each approval rather than tapping through.

How do I set a spending limit on Muse?

We couldn't find an account-level spending cap in Meta's docs. Write a hard ceiling into each task, use Stripe Link's single-use cards where possible, and use a low-limit card for agent purchases.

Is it safe to connect my bank account to Muse?

Plaid's connector lets Muse read balances, transactions and investments. Reading is lower risk than moving money. Start read-only, and review what each connector can do before enabling writes.

What should an AI agent never do without asking?

Start a subscription, change a payee's bank details, accept terms that differ from what you approved, share personal data with a new party, or enter a verification code on your behalf.