Payment mandates and transaction limits
The agent can pay or commit money only within a set mandate: payee, amount and a ceiling per transaction.
Layer L3 Application · Owner Deployer · Family Access and permissions
By risk
| Risk | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control |
|---|---|---|---|
| Unauthorised transactions or spend | 1 |
Why it was not effective
| Most common reason it was not effective | Number of incidents | Example incident |
|---|---|---|
| Reason not given | 1 | “By holding it, the Grok agent gained "Executive" permissions, allowing it to bypass standard transfer limits and swap restrictions.” LR-2026-0310 |
Incidents where it was not effective or did not exist per month
1 so far in 2026; 0 in the same span of 2025.
19 of 183 incidents in Oct 2026 have been read for controls.
Added in reported fixes, and what followed
No reported fix names this control yet.
Frameworks
| Standard | Clause | Requirement |
|---|---|---|
| NIST SP 800-53 | AC-3 | To verify when the text is stored |
| OWASP Agentic | ASI02 | To verify when the text is stored |