What I learned letting an AI agent handle real spend

I let an AI agent handle real money. Not a demo, not a sandbox — actual spend, inside IrisOS, the operations platform I've been building.

I'm writing this because Hacker News is full of AI-agent horror stories right now. An agent that bankrupted its operator. Another that deleted a production database. Reading them, I didn't feel clever or safe. I felt the weight of the problem — because I've spent weeks hardening this exact thing.

Here's the honest first-person account of what it actually takes to trust an agent with money.

Trust is a property of the system, not the model

The first thing I had to unlearn: a smarter agent is not a safer one. Capability and trustworthiness are almost unrelated. A very capable agent with no guardrails is a liability. A modest agent inside good guardrails is an asset. So I stopped asking "how do I make it smarter?" and started asking "how do I make it safe to be wrong?"

A spend cap the ledger can explain

Capping spend is the obvious move. But a cap alone isn't enough. What I actually needed was explainability: I can open the ledger and see exactly where money went and why. Every action leaves a trace I can audit after the fact. A cap tells you the damage is bounded; an explainable ledger tells you what happened inside those bounds. You want both.

Drafted for approval

The single most important boundary is this: the agent drafts outbound actions, and I approve them. It proposes; I decide. This removes most of the catastrophic failure modes people write about, because the agent never acts blindly on the outside world. The horror stories almost always share one trait — an agent taking irreversible action with no human in the loop. Closing that gap does more for trust than any amount of model tuning.

Hard time boundaries

Weekends are OFFLINE. An agent that can't act when I'm not watching is an agent that can't surprise me on a Saturday morning. Time boundaries are crude, and that's exactly why they work — they don't depend on the agent's judgment being right.

Owned hardware

IrisOS runs on hardware I own, so the files it touches never leave for a third-party cloud. That was deliberate. You can't audit what you can't see, and I wanted the whole system — the ledger, the drafts, the data — to sit where I control it.

The uncomfortable takeaway

The interesting engineering wasn't making the agent do more. It was making it do less, predictably, and making every action explainable afterward. If you're building or trusting an agent with anything that matters, I'd start with three questions:

- Can you cap it?
- Can you explain every action it took?
- Can you stop it?

Get those right, and the intelligence takes care of itself.