Agent Spend Security for Security Engineers
Prompt injection can make an agent do things its prompt never allowed — including spending. A deterministic firewall is the control a prompt can't be talked out of.
The security problem
An injected instruction in tool output can drive an agent to purchase or exfiltrate via payment rails.
Model-based 'safety' can be bypassed; a rules engine can't.
You need an audit trail for every money-touching decision.
What security teams get
A deterministic decision path — no LLM in the approval loop to inject.
Merchant allowlists that block unknown vendors regardless of what the agent claims.
A queryable audit log of every transaction decision.
How to deploy
Self-host the MIT core in your VPC; route all agent spend through it; wire the audit log to your SIEM.
What you get
| Security concern | sipi.bot answer |
|---|---|
| Prompt injection spend | Deterministic rules — no model in the path |
| Unknown merchants | Merchant allowlist |
| Audit | Rule-level queryable log |
| Supply chain | MIT core, self-host in VPC |
FAQ
Can a prompt injection bypass the firewall?
No. The decision path is a deterministic rules engine — there's no model to inject. Rules can't be argued with.
Does sipi.bot hold keys or money?
No — it's a decision API. It never holds money or private keys; your rail settles.
Where can I see the threat model?
The security page documents how sipi.bot handles security.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check