Agent safety

AI agents using Stables should follow clear financial safety rules. These rules help agents avoid accidental payments, unsupported customer activity, and compliance-sensitive actions.

Required checksCopy Anchor Link

• Start every agent on a sandbox key (sti_test_…). A live key (sti_live_…) moves real money; switch to it only after the flow has been proven end to end in sandbox.
• Confirm the customer exists before preparing a payment workflow.
• Check customer KYC/KYB status before requesting or initiating transactional actions.
• Check entitlements before using transfers or virtual accounts.
• Create and present a quote before asking for transfer approval.
• Require explicit human approval before creating a transfer or any other money movement.
• Treat sanctions, unsupported jurisdiction, compliance, and verification failures as hard stops.
• Use webhooks as the source of truth for final payment state.
• Store and display Stables IDs, external IDs, quote IDs, transfer IDs, and webhook event IDs for auditability.

What agents should not doCopy Anchor Link

• Do not initiate a transfer from an ambiguous instruction.
• Do not treat a quote as approval to move money.
• Do not bypass KYC/KYB, entitlement, or compliance checks.
• Do not retry a create-transfer request without idempotency protection.
• Do not expose API keys, customer PII, or bank details in logs or public prompts.
• Do not share one API key across agents. Create a key per agent so it can be revoked on its own, whether the agent connects through the hosted MCP server or the API directly.
• Do not make final compliance decisions; escalate flagged activity to the appropriate risk or compliance workflow.

Recommended approval promptCopy Anchor Link

Before money movement, an agent should present:

• Customer ID and verified customer name or business name
• Source currency, destination currency, and amount
• Destination rail and beneficiary details
• Quote ID, rate, fees, and expiry
• Any compliance, verification, or entitlement warnings

The transfer should only be created after the user gives clear approval for that exact payment.