Stub is the general ledger for agent spend. Set one company-wide budget across your whole fleet, and a spend that would breach it fails the database transaction before any money moves.
Agent wallets cap each session. Across a fleet, no single budget holds: every session stays in bounds while the total quietly runs over.
A failed transaction that retries can re-send an already-irreversible payment. The ledger shows one charge; the vendor was paid twice.
When finance asks how much agents spent, and on what, application logs aren't an answer. There's nothing to reconcile or audit against.
Policies, the budget hierarchy (org → team → agent), and velocity limits are evaluated inside a single ACID transaction, before any money moves.
Under concurrent cross-region writes, Aurora DSQL's optimistic concurrency control returns a serialization failure: SQLSTATE 40001. The overspend never commits.
Stub retries against the fresh balance or records a denial. The balance never goes negative. Every line is immutable and hash-chained for audit.
Correctness here isthe database's consistency model. The load-bearing property is active-active, multi-region strong consistency. A writer in us-east-1 and a writer in us-east-2 hitting the same balance resolve to one consistent outcome. No other AWS database offers it: Aurora PostgreSQL Global is single-writer, and DynamoDB global tables are eventually consistent (last-writer-wins, which means silent overspend during replication).
Org → team → agent caps, enforced together in one transaction.
Reserve, pay once, settle the real cost. A retry around an irreversible payment can't double-charge.
Per-transaction and rolling-window caps, vendor rules, approval thresholds.
Tag every spend to a team, customer, or feature and answer chargeback questions cloud bills can't.
Hash-chained entries that detect any altered row, exportable as accounting journal lines.
Runaway spend trips a limit and auto-freezes the account.
Freeze one agent or the entire fleet instantly.
Plain-English questions answered over the ledger, never raw SQL.
Drop the budget gate in front of any paid call. Money moves only after it commits.
Replay a runaway agent and watch the overspend get refused, transaction by transaction.