Docs · Cards
Limits stores card data for agent-scoped access and purchase approvals. The current card flow is test mode only; it does not issue cards or contact a bank.
Add a card with the public Limits test number. Card details are encrypted in the browser before saving. Real card numbers are not accepted in the test card workflow. Card storage for real financial accounts remains closed until the security and PCI DSS scope review is complete.
Assign each test card to one active agent in this Limits account. The assignment grants that agent access to this card while keeping the account's explicit deny rules and space policy in force. Use separate cards for separate agents when your bank or provider supports that setup.
Per-purchase approval is on by default. Fill-only keeps card fields from being returned as text to a general MCP client; a Limits-aware payment helper is required to fill a form. Return-after-approval lets the approved test fields be sent through Limits to the assigned agent using an encrypted release.
Turning off purchase approvals requires an explicit confirmation and converts the public test card from device-held to server-managed encryption. The Limits service can then decrypt it while handling an unattended request. Re-enabling approvals restores device-held protection and removes server-decryptable card versions from item history.
Cutting off a card blocks new requests, removes its agent assignment, and cancels pending payment requests. A cut-off card with payment history stays in Limits for audit purposes. Also freeze or cancel the card at your bank or provider: a card number already released to an agent may be used outside Limits.
A card belongs to the Limits account that stored it and can be assigned only to an agent in that account. For agents operated from separate Limits accounts, create and assign separate cards inside each account. Do not share vault keys or device profiles between accounts.
Limits does not issue cards, hold funds, or process charges. Test-mode limits are encrypted example data. Any real spending limit and transaction controls must be configured with the bank or card provider.