--- title: "Agent Action Control: AI agent action guardrails · Audon" description: "Guardrails for AI agent refunds, credits and discounts: each action checked against your rules before it runs, verified at Stripe or Shopify, kept as evidence." url: https://audon.ai/product/agent-action-control last_updated: 2026-11-02 --- What your agents doNew # Agent Action Control. Every action checked before it runs, verified and on record. Refunds, credits and discounts your agents propose, checked against your rules before they run and verified at the provider. [Start action auditFree](https://audon.ai/sign-up?intent=integrity) [Read the docs](https://audon.ai/docs/action-control) Any model, any framework Audon controls the actions, not the model. One call checks and executes Nothing can change between the check and the run. Deterministic rules The same action gets the same decision, every time. Stripe, Shopify, webhooks Connect Stripe or Shopify in one click; any system through a signed webhook. ## What is Agent Action Control? Agent Action Control is Audon’s product for controlling what AI agents do with money. Every refund, credit, discount, subscription change or order cancel an agent proposes is checked against your rules before it runs, executed through Stripe, Shopify or a signed webhook, verified at the provider and kept as evidence. Formerly Agent Action Integrity. ## Six steps, one call. The check and the execution are coupled, so nothing changes in between. 1. 1 Propose The agent proposes an action with an idempotency key. 2. 2 Check Permissions, rules, limits, duplicates and approvals. 3. 3 Decide Allowed, denied or sent for approval, with the reason. 4. 4 Execute Through Audon’s connector, with an idempotency key. 5. 5 Verify Audon re-reads the result at the provider before Completed. 6. 6 Record Every step kept as evidence: append-only, hash-chained. ### When the outcome is unclear, Audon asks the provider first. A timeout makes the outcome Unknown. Audon looks the action up at the provider before anything is retried. Refund · $450.00 · act_9Lp2… 1. Sent to Stripe10:42:03 2. No answer after 10 s: Unknown10:42:13 Not retried. Counted as exposure. 3. Checking provider state10:42:43 Refunds on the charge with audon_action_id 4. Completed, verified10:42:44 Found re_3QmX…; nothing to retry. Outcomes What the provider answered | Provider answer | Outcome | Retry | | --- | --- | --- | | 2xx with a status | Completed, verified by re-reading the object | Not needed | | 4xx, or refused before sending | Failed: the provider confirmed it didn’t happen | Safe, with the next attempt key | | Timeout after sending, 409, 5xx | Unknown: counted as exposure | Only after Audon resolves it | Decision and outcome are separate fields: an allowed action can still fail at the provider, and Audon says so. ## Six functions. Each one runs in the same call, before anything executes. - ### Action authorization Each agent has its own key and a list of actions it may run. Pause an agent and every action it proposes is denied. - ### Financial guardrails Per-action caps, rolling budgets and velocity limits per agent, customer or organization, on top of built-in rules. - ### Duplicate prevention The same action on the same order within 72 hours is caught, and one idempotency key always means one execution. - ### Human approvals Above your threshold, a person with the approver role is emailed and decides in the app. An expired request counts as denied. - ### Outcome verification Completed means Audon re-read the object at the provider. An unclear outcome is looked up first, with no blind retries. - ### Audit and evidence Every check, decision and outcome is kept with the rule version it ran on, ready for an investigation or an auditor. ## Three ways in. Start read-only, then put actions behind the gate. Most teams begin with the free action audit on their own history, then route live actions through the Action Gateway or the SDK. ### Free action auditRead-only Connect Stripe or your Shopify store in one click (one install; Audon only reads until you turn on protection for an agent) and, if you have them, upload agent logs (JSONL or OpenTelemetry). Audon reads up to 90 days and flags: - Duplicate refunds per charge or order - Refunds above the payment - Unusual discounts and credits - Bursts per agent or customer - Failed and repeated actions [How the action audit works](https://audon.ai/audit/actions) ### Action GatewayMCP Point the agent’s tools at a managed MCP endpoint, with an agent key. Each action the agent may run becomes a tool, and every call goes through the checks. ``` https://audon.ai/mcp/actions Authorization: Bearer aa_agent_… tools: refund_create, credit_create, discount_create, subscription_cancel, subscription_update, order_cancel, action_status, action_retry ``` ### integrity.execute() The TypeScript SDK for teams that build their own agents. One call proposes, checks and executes; a denial is a result with its reason, never an exception to catch. The package isn’t on npm yet; the REST call it wraps works today. ``` before agent → Stripe API after agent → Audon → Stripe API decision allowed · denied pending_approval · would_deny outcome completed · failed · unknown ``` Developers @audon/sdk ``` import { Audon, idempotencyKey } from '@audon/sdk'; const audon = new Audon({ apiKey: process.env.AUDON_AGENT_KEY! }); const result = await audon.integrity.execute({ agent: 'customer-support-agent', action: 'refund.create', resource: 'ch_3QmX…', // the Stripe charge amount: 45000, // minor units: USD 450.00 currency: 'USD', idempotencyKey: idempotencyKey('refund', 'order_8812', 'ticket_5602'), }); if (result.decision === 'denied') { // result.decision_reason: "Order already fully refunded." } ``` ## Check and execute in one call. Not a check, then a direct API call. A separate permission check before a direct call leaves a moment in which the order, the balance or the limit can change. integrity.execute() runs the checks and the execution under one lock and returns the decision and the verified outcome. [SDK quickstart](https://audon.ai/docs/action-control/quickstart) [Action Gateway setup](https://audon.ai/docs/action-control/gateway) ## Rules in your words. Run as deterministic code. Describe a rule the way you’d tell a new colleague. Audon drafts it, shows what it would have done, and a person turns it on. 1. 1 Describe Write the rule in plain language. 2. 2 Draft Audon turns it into a structured rule and validates it against the schema. 3. 3 Replay See what it would have allowed, denied or sent for approval on your history, with a warning for a rule that always allows or never matches. 4. 4 Confirm A person activates the new version. Every decision records the version it ran on. Policies Refunds Draft v3 Synthetic example Describe the rule Our support agent may refund up to $100 on its own. Above that, a manager approves. Structured rule Valid ``` { "id": "refund-approval", "effect": "require_approval", "match": { "agents": ["support-agent"], "action_types": ["refund.create"], "amount": { "gt": 10000, "currency": "USD" } }, "approval": { "roles": ["owner", "admin"], "timeout_minutes": 1440 } } ``` Allowed 2,176 To approval 38 Denied 0 Replay on the last 30 days · 2,214 refunds · 38 decisions change Edit Activate v3 ## One grammar for evidence. Blocked is potential. Proof makes it confirmed. The same rules as savings in Agent Spend Optimization: potential and confirmed amounts are always shown apart, and only confirmed is green. Action Control Evidence classes | Class | What it means | Shown as | | --- | --- | --- | | Observed action | Audon recorded the action, its decision and its outcome. | Activity | | Flagged action | An audit finding or anomaly worth a look, such as a possible duplicate refund. | To review | | Potentially prevented loss | A blocked or held attempt, at its amount at risk. Retries of one intent count once. | Potential, kept apart from confirmed | | Confirmed prevented loss | Proof the action would have executed and caused loss: a duplicate the provider would have accepted, or a reviewer’s confirmation on record. | Confirmed: the only green | | Outcome unknown | The provider’s state isn’t known yet. Audon keeps looking it up. | Exposure, until resolved | | Suspected or confirmed loss | What the read-only audit finds in your history: losses that already happened, so they can be recovered. | Audit findings | ## Route every action through Audon. And remove the agent’s direct access. The controls hold for the actions that pass through them. Give the agent an Audon agent key in place of its own payment keys, and remove its direct access to the same APIs; otherwise the controls can be bypassed. Setup shows this step for every connector. **Agent keys execute** One key per agent, bound to its allowed actions. People and admin keys hold no execute right. **People approve** Approvals and policy activation need a signed-in person with the right role. **Least-privilege connections** One official Stripe or Shopify app install. Audon only reads until you turn on protection for an agent; restricted keys work as a fallback. **Encrypted secrets** Access tokens and keys are envelope-encrypted, refreshed by Audon and never shown again. **Signed webhooks** Every webhook request is signed and carries the idempotency key. **Append-only evidence** Records are hash-chained; the database refuses to change them. ## Questions teams ask before routing actions. **What is Agent Action Control?** Agent Action Control is Audon’s product for controlling what AI agents do with money. Every refund, credit, discount, subscription change or order cancel an agent proposes is checked against your rules before it runs, executed through Stripe, Shopify or a signed webhook, verified at the provider and kept as evidence. It works with any model, agent or framework, because it controls the actions, not the model. **Is this the same as Agent Action Integrity?** Yes. Agent Action Integrity was renamed Agent Action Control in November 2026. The product, your data, your plan and the API are the same: endpoints, scopes and identifiers such as integrity.execute didn’t change, and old links lead here. **Do we have to change our agent?** For the free action audit, no: it reads Stripe or Shopify and your agent logs. To protect live actions, either point the agent’s tools at the Action Gateway (an MCP endpoint) or call integrity.execute() from your code. Either way, the agent stops calling the payment API directly. **Which actions and systems are supported?** Stripe, connected in one click: refunds on a charge or payment intent, customer balance credits, single-use coupons, and subscription cancel and update. Shopify, connected in one click: order refunds, order cancellations, single-use discount codes, and store credit or gift cards. Any other system works through the Webhook connector: your endpoint executes the action, Audon signs the request, sends an idempotency key and asks your status endpoint when an outcome is unclear. **Does a language model decide whether an action is allowed?** No. Decisions come from deterministic rules: the same facts always give the same decision, and every decision records the rule version. A model only helps draft a rule from your words; a person reviews the replay and activates it. **What happens when Audon can’t tell whether an action ran?** The outcome becomes Unknown and counts as exposure. Audon looks the action up at the provider, first after 30 seconds and then backing off, and resolves it to Completed or Failed. A retry is allowed only after that, with the next attempt key. **What counts as prevented loss?** A blocked attempt is potentially prevented loss, at the amount at risk, and retries of the same intent count once. It becomes confirmed prevented loss only with proof that the action would otherwise have executed, for example a duplicate credit the provider would have applied, or a reviewer’s confirmation on record. Losses the historical audit finds are suspected or confirmed losses, never prevented ones. **Can we try our policies without blocking anything?** Yes. An organization starts in monitoring: actions your own policies would deny run and are marked Would deny, so you can tune the rules on real traffic. Audon’s built-in safety checks block from the first action, in every mode: a duplicate refund, a refund above what’s left to refund, a refund on a fully refunded or disputed order, a paused agent. A person switches your policies to enforcing for the whole organization or one agent at a time. **How is it priced?** The action audit is free. Every plan includes protected actions each month: 500 on the free plan, 10,000 on Starter and 100,000 on Growth. Beyond that, $20 per 1,000 actions (2 US cents an action), billed monthly in arrears on the same invoice; you get an email at 80% and 100% of the included volume. See [pricing](https://audon.ai/pricing#action-control). Last updated 2 November 2026 ## Connectors. Where your agents’ actions run. - [Stripe Refunds, credits, discounts and subscription changes, checked before they run and verified at Stripe. How it works](https://audon.ai/integrations/stripe) - [Shopify Refunds, cancellations, discount codes and store credit, checked before they run. How it works](https://audon.ai/integrations/shopify) - [Webhook Your endpoint executes: signed requests, idempotency keys and a status endpoint for unclear outcomes. How it works](https://audon.ai/integrations/webhook) ## Every action checked. Every outcome on record. [Start action auditFree](https://audon.ai/sign-up?intent=integrity) [See pricing](https://audon.ai/pricing#action-control)