USE CASE · Media buying agents

Media spend that respects
the cap — and the brand.

Media-buying agents run Google, Meta, TikTok, LinkedIn, programmatic DSPs — each on its own scoped card with hard daily caps, MCC locks, and frequency throttles. No more 3 AM overspend, no more shared Amex shared across 8 platforms.

$20k/d
default cap
8
ad platforms
1s
cap-hit kill
trace
per-campaign
The problem

Why the corporate card
doesn't work for this agent.

Platforms ignore caps

Google Ads says your daily cap is $5k, but a single bid surge can push that to $5k × 2 (their documented 'over-delivery'). On a hot day across 8 platforms, you find out at 9 AM you spent 6× your budget overnight.

One Amex, eight platforms

Shared corporate Amex on Google, Meta, TikTok, LinkedIn, Reddit, Pinterest, Snap, X. When one platform double-bills, finance can't tell which. When the Amex rotates, all 8 break at once.

Agency commingling

Working with an agency? Their card, your spend. End-of-quarter reconciliation against agency invoices is a multi-week project; rebates and FX surprises get lost in the margin.

What the wallet ships with

Everything this agent needs.
Nothing it doesn't.

Per-platform virtual cards
One card per ad platform with a hard daily cap enforced at network authorization. Google Ads card simply can't charge more than $5k today, regardless of platform 'over-delivery.'
MCC lock
Each card MCC-locked to ad-platform billing (5734 / 7372 / 5817 depending on platform). Compromise or misconfiguration can't drift spend into unrelated merchants.
Per-campaign trace
Tag the agent's invocations with campaign_id. Every charge carries that trace, so per-campaign spend is queryable directly against the AgentWallet ledger — even cross-platform.
Frequency throttle
Cap not just on dollars but on charge rate — e.g., no more than 12 charges/hour from any one platform. Stops runaway 'auto-renew on failure' loops cold.
Agency-direct billing
Run agency campaigns on a card your agency cannot share. They use the card, you own the cap, the ledger is yours. End-of-quarter reconciliation is one CSV.
Geo-restricted cards
Targeting US-only? Card geo-locked to US ad-platform charges. Stops a misconfigured campaign from running in the wrong region without a budget approval.
Cap-hit instant kill
Daily cap hit at 4 PM? Card auto-freezes within 1 second of the limit. Tomorrow, cap rolls and the card unfreezes automatically. No 'cron job' to forget.
Cross-platform reconcile
GET /api/ledger?trace=campaign-abc returns every charge across every platform for that campaign. Pivot by day, by platform, by creative — without leaving the wallet.
A day in the life

From mandate to settlement.

01
01 · Mandate

CMO signs budget

CMO signs an IntentMandate: '$200k for Q3 across Google, Meta, TikTok; cap $20k/day.' Mandate bound to one media-buying agent.

02
02 · Provision

Cards per platform

Agent provisions 3 cards, each with the appropriate per-platform cap. Loads campaign IDs as traces; sets MCC and geo locks.

03
03 · Buy

Daily spend

Agent runs campaigns; each platform charges its card; daily caps enforce. A bidding war on Meta hits $5k by 3 PM and the card freezes for the day.

04
04 · Audit

Per-campaign export

End of week, marketing exports trace=campaign-jul-launch and sees $84k spent, broken out by platform and day. Reconciliation: one query.

Vendors typically allowlisted

Plug-and-play merchant lists.

Curated merchant allowlists ship with the wallet template. Add your own in one API call or one click in the portal.

Google AdsMeta AdsTikTok AdsLinkedIn AdsReddit AdsPinterestSnap AdsX (Twitter) AdsThe Trade DeskDV360StackAdaptMNTNSpotify AdsApple Search Ads
Recommended starter policy

Defaults you can flex.

Daily cap (rolling 24h)$20,000
Per-platform daily$5,000
Charge rate cap12/hour per platform
Allowed MCC5734 · 7372 · 5817
Geo lockCampaign target geos only
Cap-hit behaviorAuto-freeze; auto-unfreeze 24h
In depth

Everything else you need to know.

Why ad-platform caps are not real caps.

Google Ads documents that daily budgets can over-deliver by up to 2× on any given day. Meta has similar over-delivery behavior. TikTok's pacing algorithm can spike spend in the last hour of a day to hit pacing targets. The 'budget' you set in each platform's UI is a guideline to the platform's bidder, not a hard cap on what gets billed to your card.

AgentWallet's per-platform virtual card is the hard cap. The card is configured to refuse authorization above your real daily limit. If Google's algorithm tries to over-deliver, the over-delivery auth is declined by the card network; the campaign throttles. You set the limit once; the card enforces it for every charge, all day, every day, without any cron job or budget-watcher script.

Per-campaign attribution across 8 platforms.

The hardest reconciliation problem in media buying is per-campaign cost across heterogeneous platforms. Google reports its way, Meta reports its way, TikTok exports differently. The result is that 'how much did our July product launch cost' is a 3-day analyst project that pulls from 8 sources and rarely agrees with the credit-card statement.

AgentWallet collapses this. The media-buying agent tags every invocation with the campaign_id; every charge across every platform carries that ID as its trace. One SQL query against the AgentWallet ledger produces total spend for the campaign, broken out by platform, day, creative variant. The number agrees with finance's view of the card statements, because it is the card statement.

Charge-rate caps that catch broken auto-renew.

A common failure mode: a platform's auto-renew or auto-bid loop fails and starts retrying every 30 seconds. With a $20k daily cap, the platform can burn $20k in a few minutes if the rate is uncontrolled. AgentWallet's charge-rate cap (default 12 charges/hour per card) catches this within minutes — the 13th charge in an hour is refused at the network, the card auto-freezes, you're paged.

This is invisible to the ad platform — they see your card refusing and back off — but it's the difference between catching the runaway in minutes versus catching it at the next morning's standup.

Agency relationships without commingled cards.

Working with an agency historically meant either putting your card on their account (and losing visibility and control) or having the agency front the spend and invoice you (and dealing with rebates, FX, and a multi-week reconciliation lag). AgentWallet lets you issue a per-platform card directly to the agency: they use it; you own the cap, the trace, the ledger.

End-of-quarter reconciliation against the agency's invoice is a CSV diff. Discrepancies surface immediately (down to the campaign and day). Agencies that resist this are usually the agencies you should not be working with.

FAQ

Common questions.

What happens when a campaign's daily cap is hit mid-day?
The card auto-freezes within 1 second of crossing the cap. The platform's next auth is declined; the platform throttles the campaign on its end. At the cap's rollover (24h from the first charge of the day, not calendar midnight), the card auto-unfreezes. You can also configure a manual approval to bump the cap mid-day.
Can I have one card across all ad platforms?
Yes, but per-platform cards are the recommended default. The benefits of a single card are: simpler reconciliation if you don't need per-platform attribution, one card to rotate. The downsides: one platform's billing bug burns the whole budget; per-platform caps must be enforced in policy logic rather than at the network.
Does this work for programmatic DSPs like The Trade Desk or DV360?
Yes. DSPs bill on the same card-acceptance rails as direct platforms. The Trade Desk, DV360, StackAdapt, MNTN are all supported with the same MCC-locking and per-campaign trace approach.
How do you handle currency conversion?
Each card can be denominated in any of 91 supported currencies. EU-targeted campaigns run on an EUR-denominated card; the daily cap is enforced in EUR; the ledger row records EUR spend, FX rate at settlement, and USD equivalent.
Can I get per-creative attribution, not just per-campaign?
Yes — the trace is any string you want. Use campaign_id for campaign attribution, creative_id for creative attribution, or both as a structured trace. The agent passes whatever you configure; AgentWallet stores it and indexes it.
What about platforms that require a domestic billing address?
Each AgentWallet card can be issued with a configurable billing address. For platforms that require a US business address, issue the card with one; for EU campaigns under an EU entity, issue with the EU billing address. KYB at signup determines which billing addresses you're enabled for.

Ship this agent today.

Provision a wallet, attach a verified principal, set caps, plug into your LLM via MCP. Live in under a minute.