Agent-commerce rails (x402, delegated payment tokens, prepaid credits) answer how an agent pays. The harder question is what stops an agent — or a buggy loop, or a malicious counterparty — from paying wrongly. The answer is never "the model will be careful." It's four invariants enforced server-side, where the model can't break them.
1. Hard caps, enforced by the seller
A budget cap that lives in the agent's prompt is a suggestion. A cap the seller's API enforces on every charge path is a guarantee. Test it: authorize a purchase with a cap below the unit price and confirm you get a structured refusal (budget_cap_exceeded, insufficient_credits) instead of a partial charge. At Forward, the cap is clamped at checkout on every rail — an agent literally cannot spend past it.
2. Itemized charges tied to deliverables
"$500 — services" is unauditable by humans and agents alike. Each charge should reference one identifiable result with attached evidence — at Forward, one charge per result_id, each carrying the verification record that justified it. An agent can then reconcile spend against deliverables mechanically, every billing cycle, with no judgment calls.
3. Idempotency everywhere money moves
Agents retry. Networks duplicate. If the same result or the same checkout can bill twice, it eventually will. Idempotency keys on every charge (and unique constraints under them, so races lose) are table stakes — ask a vendor what happens when the same result is processed twice and listen for a database answer, not a process answer.
4. Reversibility as a code path, not a support ticket
When a deliverable later fails acceptance, the refund should be automatic — an audit-logged reversal, credits restored, no email thread. If "reversal" routes through a human queue, autonomous spending is autonomous only in one direction.
The checklist
Before pointing an agent with a wallet at any service: structured machine-readable errors? Cap enforced server-side (test it)? Charges itemized per deliverable with evidence? Idempotent under retry? Reversal automatic? Free tier to test the whole loop without real money? Forward publishes its answers in llms.txt and gives every new account $25 in credits so an agent can verify all six claims empirically before a dollar is at stake — which is exactly the level of trust-but-verify agent commerce needs.