sipi.bot vs building custom spend middleware
Every team with an agent that spends money eventually writes a guard function. Here's what that guard function grows into, and why teams ship it to sipi.bot instead of maintaining it forever.
The life cycle of a custom spend guard
Week 1: if amount > 500: raise ValueError. Week 2: add a merchant list. Week 4: add daily totals in Redis. Week 8: add a human approval queue. Week 12: add an audit log. Week 16: realize you've built a worse version of sipi.bot, with no test suite, no eval gym, and your intern maintaining it.
| What you need | DIY middleware effort | sipi.bot |
|---|---|---|
| Per-transaction cap | 2 lines of Python | Built-in |
| Merchant allow/block list | A dict and an if statement | Built-in, configurable in dashboard |
| Daily spending total across agents | Redis or Postgres, TTL keys, race conditions | Built-in, single writer, no races |
| Velocity / runaway-loop protection | Sliding window counter, careful edge cases | Built-in, 53-scenario eval gym verified |
| Human approval queue | Slack bot or custom dashboard | Built-in dashboard with Approve/Deny |
| Tamper-evident audit log | Append-only table, hash chaining | Built-in, every decision logged |
| Testing and maintenance | Your team's burden forever | Our team's burden; open-source core you can audit |
The real cost is maintenance
Building the first version takes a weekend. Maintaining it — handling edge cases, fixing race conditions, adding features as your agent fleet grows, writing tests for every new rule — is a permanent tax on your team. sipi.bot costs $99/mo and ships with a 53-scenario eval suite that proves every rule works. The alternative is paying your engineer $150/hour to maintain a custom guard forever.
Frequently asked
Is building a custom guard really that hard?
The v1 is easy — one if statement. The v5 (daily totals, velocity, human-in-the-loop, audit trail) is a non-trivial distributed systems problem. sipi.bot has already solved it, tested it, and open-sourced the core.
Can I extend sipi.bot if my needs are unique?
Yes. The core is MIT-licensed and runs on your hardware. Fork it, add custom rule types, wire in your own notification channels. The hosted version gives you uptime and support; the code is yours to modify.
What if I only need per-transaction caps?
If that's truly all you need, a 2-line guard function is fine. The question is: will you still only need per-transaction caps in six months, when your agent fleet has grown and your CFO is asking about audit trails?