# Let an AI agent touch Stripe without letting it move money

Refunds, payouts, and disputes are irreversible the moment they fire. Cap the amounts, gate the approvals, and close the raw-API back door.

For: Finance and RevOps teams giving an agent access to payments

Payment actions are the rare agent write with no undo. A refund is money out the door; a dispute submission is a decision you can't recall; a payout goes where it goes. An agent that drafts a customer email is low-stakes — an agent that can call the refund tool is not.

The controls gate money movement at ingress. `gate-money-movement-refund-cap` caps refund and payment amounts and denies anything above the ceiling unless the caller is in the finance group. `require-human-approval-dispute-submit` keeps the agent from consummating a dispute on its own. `role-gate-writes-billing` restricts billing writes to authorized identities, and `deny-escape-hatches-api-write` blocks the raw pass-through tool that would otherwise let an agent route around every per-tool rule. On the way back, `redact-pii-egress-customer` masks customer PII in responses.

The posture is simple to state: the agent can read, reconcile, and draft, but it cannot move money past a threshold or bypass the controls to try.

## Policies in this guide

- [Stripe Refund Group Gate and Amount Cap](https://www.intentbasedpolicy.com/policies/stripe/gate-money-movement-refund-cap) — Denies Stripe refund tool calls — money out, irreversible — unless the caller's IdP groups include finance or billing-admin.
- [Human-Only Stripe Dispute Submission](https://www.intentbasedpolicy.com/policies/stripe/require-human-approval-dispute-submit) — Strips the irreversible submit flag from Stripe update dispute tool calls.
- [Deny Stripe API-Write Escape Hatch](https://www.intentbasedpolicy.com/policies/stripe/deny-escape-hatches-api-write) — Denies the stripe api write meta-tool — the single raw passthrough on the official Stripe MCP server that can execute any Stripe POST, PATCH, PUT, or DELETE…
- [Read-Only Stripe by Default (Role-Gate Billing Writes)](https://www.intentbasedpolicy.com/policies/stripe/role-gate-writes-billing) — Establishes a read-only-by-default Stripe posture over the MCP path. The named write and destructive billing tools —
- [Stripe: Redact Customer PII from Bulk Reads](https://www.intentbasedpolicy.com/policies/stripe/redact-pii-egress-customer) — Masks customer PII in the responses of Stripe's bulk PII egress channels before they reach the agent.