What's inside

One SKILL.md (the playbook) + one starter template. A preview:

Agent Commerce Risk Checklist

When to use

• Before any AI agent gets payment credentials, card access, or "buy" buttons.
• After a surprise charge, a duplicate order, or an agent buying something nobody wanted.
• You're reviewing a vendor's "agentic commerce" feature and need the questions that matter.
• Quarterly: re-run it, because commerce agents accrete permissions silently.

Workflow

1. Scope the money (input: what the agent can spend → output: money map)
   List every payment path: stored cards, bank connections, platform credits, crypto wallets, "buy now" buttons in tools it can click. For each: whose money, what limits exist today (card limits don't count — they're the bank's, not yours), and what a single runaway session could spend. If you can't enumerate the paths, the agent doesn't get credentials yet.
2. Cap every transaction (input: money map → output: cap table)
   Set three caps: per-transaction (above this = human approval, no exceptions), per-day, and per-merchant-per-week (catches the slow drip). Caps live in your system, not in the agent's prompt — a cap the agent can talk itself out of isn't a cap. Include subscriptions and auto-renewals explicitly: "buy" is not the only way money leaves.
3. Gate the consequential (input: cap table → output: approval matrix)
   Define what always needs a human: over-cap amounts, new merchants, non-refundable purchases, anything affecting someone else's money, and any order the agent can't explain in one sentence. Approval goes to the human's own device with the full order visible; timeout = deny; the agent may not re-ask for the same order in the same session (no approval nagging into a yes).
4. Shrink the credentials (input: approval matrix → output: credential spec)
   The agent gets the narrowest payment capability that works: virtual single-merchant cards, scoped tokens with spending limits, or a dedicated low-balance funding source — never the primary card, never the business account. Credentials are per-agent-instance, rotated on schedule, and revoked the moment the job ends. Test: if this credential leaked today, what's the maximum damage? That number must be boring.
5. Log everything money-adjacent (input: credential spec → output: audit spec)
   Every quote, cart, order attempt, approval, decline, refund, and subscription change — timestamped, with the agent version and the human principal attached. Keep 13 months minimum (chargeback windows). Review weekly: total spend per agent, decline rate, and any merchant you don't recognize. The weekly review is the control; the log is just the evidence.
6. Rehearse the bad day (input: full checklist → output: incident one-pager)
   Write the one-pager before you need it: runaway ordering (kill switch → which credentials to revoke → who refunds), credential leak (revoke → assess max damage → notify), disputed charge (receipt lookup → refund rule). Name the human who owns money incidents and the maximum time to containment. Then run the drill once — revoking a test credential — so the one-pager isn't fiction.

Template preview

Agent Commerce Risk Worksheet

Run before the agent touches money. Re-run quarterly.

1. Money map

Can't enumerate the paths? No credentials yet.

2. Cap table (enforced in YOUR system, not the agent's prompt)

• Per-transaction cap (above = human approval, no exceptions):
• Per-day cap:
• Per-merchant-per-week cap:
• Subscriptions / auto-renewals / free trials: gated like purchases [ ] yes

3. Approval matrix

Always needs a human: over-cap / new merchant / non-refundable / someone else's money / unexplainable order.

• Approval goes to the human's own device, full order visible: [ ] yes
• Timeout = deny: [ ] yes
• No re-asking the same order in one session: [ ] yes

Buy the full skill pack — $4.99 Pro — all 511 skills