Disclosure: I work on Pink Agentic AI Payments at PinkWallet, a payment-control layer for AI agents. This survey covers general-purpose agent frameworks, not payment products, and Pink is not in the table. Every cell links to the framework's own docs: github.com/Pink-Agentic-Payments/agent-framework-spend-guardrails.
Short answer: none of the 12 most popular agent frameworks documents a spending budget in currency for tool calls. They can make an agent stop after N steps (9 of 12) or pause for a human (10 of 12), but none of them knows what a single tool call costs in dollars. If your agent can spend money, the cap has to come from somewhere else.
The 12 frameworks and 8 controls
We checked each framework's own documentation or source code on 2026-10-09 for eight controls:
- C1 human approval before a tool runs
- C2 a programmatic per-tool hook that can block a call
- C3 max steps / iterations / turns
- C4 a token or LLM-cost budget for a run
- C5 a money budget for tools, in currency
- C6 a tool-call rate limit
- C7 idempotency / dedup of tool calls
- C8 a built-in audit log of tool calls with arguments
| Framework | C1 | C2 | C3 | C4 | C5 | C6 | C7 | C8 |
|---|---|---|---|---|---|---|---|---|
| LangChain/LangGraph | yes | yes | yes | partial | no | yes | no | n/d |
| CrewAI | yes | yes | yes | no | no | yes | no | partial |
| OpenAI Agents SDK | yes | yes | yes | n/d | no | n/d | n/d | partial |
| Vercel AI SDK | partial | yes | yes | partial | no | n/d | n/d | partial |
| Google ADK | yes | yes | yes | no | no | n/d | n/d | partial |
| Microsoft AutoGen | partial | n/d | yes | yes | no | n/d | n/d | n/d |
| Semantic Kernel | n/d | yes | n/d | n/d | no | n/d | n/d | partial |
| LlamaIndex | yes | n/d | n/d | n/d | no | n/d | n/d | n/d |
| Pydantic AI | yes | yes | yes | yes | no | yes | n/d | n/d |
| Mastra | yes | yes | n/d | partial | no | n/d | n/d | n/d |
| Claude Agent SDK | yes | yes | yes | n/d | no | n/d | n/d | n/d |
| smolagents | no | no | yes | no | no | no | no | partial |
n/d = not documented.
What the table says
- 0 of 12 document a currency budget for tool calls (C5). That is fair to say plainly: these are general-purpose frameworks, so a dollar cap was never their job.
- 10 of 12 offer some form of human approval (C1 yes or partial), but not all of them can gate one specific tool call; some only stop the whole run.
- 9 of 12 can block a specific tool call in code (C2), not just by prompt instruction. That hook is where a spending check can be plugged in.
- 9 of 12 document a max-steps limit (C3), the most common control in the survey.
- Only 2 of 12 document a clean token or cost budget for a run (C4 = yes), with 3 more partial. And a token budget limits what the model costs, not what the agent buys.
So where should the spending cap live?
Not in the prompt. "Never spend more than $50" is text in the model's context; it can be misread, forgotten, or overridden by a prompt injection.
Use the framework hook (C2) to call something outside the model that knows the money: the payment API or a control layer in front of it. That layer should hold the budget, the per-payment cap, the allowed payees and the approval rule, and it should answer before the payment executes. Three outcomes cover almost every case: allow, ask a human (with silence meaning no), or block.
A companion census of 49 payment MCP servers found the same gap from the other side: of 37 servers that can move money, only 4 document a spending budget and only 6 document human approval (payment-mcp-census).
Try it
Pink's public sandbox gives an agent seven MCP tools (pink.get_budget, pink.check_policy, pink.request_payment and friends) and answers every request with allowed / pending_human / blocked against per-agent budgets and rules. Test money only: agentic-sandbox.pinkwallet.com. There are runnable LangGraph, OpenAI Agents SDK, CrewAI and Vercel AI SDK examples in sandbox-examples.
If we got a cell wrong for your framework, open an issue with a docs link and we will fix it.
Top comments (8)
Useful table, and the C4 vs C5 split matches what I ran into on the LLM side. Building multi-agent platforms for clients, the problem was never one call, it was not knowing at month end which agent in the tree had burned the budget. We were reconciling it with spreadsheets and shell scripts after the fact.
One thing I'd add to the "put the check in the C2 hook" advice: once several agents share a budget and run in parallel, check-then-spend races. Two calls each see $40 left and both go through. The control layer needs to reserve the estimated amount atomically before the call and settle the real cost after, otherwise the cap leaks under concurrency. Same shape as your split-payment problem, just across agents instead of across payments.
Did any of the 12 frameworks run the hook before parallel tool calls are dispatched, or do they all fire per call?
The check-then-spend race is exactly the failure that a per-call hook hides: two calls both see $40 left. Reserve-then-settle is the right shape.
On your question: the survey only recorded whether a per-tool hook exists (C2), not whether it runs before parallel calls are dispatched, so I cannot claim any of the 12 do. That is worth checking properly.
For what it is worth, we tested the shared-ceiling case on Pink's sandbox: three agents firing 40 concurrent requests against one $6,000 daily ceiling landed at the ceiling in both runs, with every block naming the ceiling. It is a sandbox test, not a proof of atomicity: pinkwallet.com/agentic/learn/give-...
Fair that a sandbox run isn't proof of atomicity, but landing exactly on the ceiling in both runs is a good sign. The test I'd add is one built to break it: set the ceiling just above the cost of a single request, fire all 40 at once, and check total spend never goes past it. Then kill the guard mid-run so you also exercise the fail-closed path, and confirm those calls come back blocked with a reason instead of being retried.
Would be great to see the parallel-dispatch question added to the survey. A per-call hook that can't see the other calls in the same batch is exactly where these caps leak.
Some comments may only be visible to logged-in visitors. Sign in to view all comments.