Docs Start here

Cards in practice

Six ways people use a KIFF Card, each with what the Card says, what happens when the agent acts, and where you see it. The first uses a connected tool; the next two are jobs that Cards → Issue a card offers; the rest work with any Card.

A refund agent with a daily budget

A support agent refunds orders through a shop’s MCP tool, refund_order, connected to KIFF. The owner gives it a Card from the tool’s Give an agent a Card:

refund-agent may call refund_order
up to 100 EUR a day, at most 20 EUR a call
past that: Ask (hold it for an approver, 10 minutes)
  • A 15 EUR refund is inside the Card. KIFF sends it to the tool, and the Card shows 85 EUR left today.
  • A 25 EUR refund is over the 20 EUR a call. Nothing is sent. The call waits on Needs you with the amount, why it is held and the Card, and the owner gets one email. In Claude Code the chat can offer the link too.
  • The owner chooses Approve once. The agent retries the same call, and KIFF sends it once. The 25 EUR counts toward the 100 EUR day: approving waives the per-call limit, not the total.
  • The tool’s answer is recorded beside the approval. Needs you shows Tool reported it done, or Refused by the tool if, say, only 20 EUR of the order was left to refund.
  • A refund that would go past 100 EUR today cannot be approved past the total. The owner can choose Review extra room, which adds room for this day only unless they pick otherwise, or reject it.

Where you see it: Needs you → Answered, and the Card’s History → Approved once and Statement. See Held calls and approvals.

Needs you, Answered: refund_order 25 EUR from onboard-agent, approved once, and the tool reported it done; below it, two get_order calls approved once and refused by the tool.

Needs you on a KIFF test account, where this example ran: the 25 EUR refund, approved once.

Store credit only on eligible cases

A retention agent offers store credit to customers who are about to cancel. The owner issues a Card for the job Issue store credit:

retention-agent may ISSUE_STORE_CREDIT
up to 500 EUR a day

The job’s domain allows credit only on a retention case marked ELIGIBLE. Once a case is credited it becomes CREDITED, so:

  • credit on an eligible case, inside the 500 EUR, is allowed;
  • a second credit on the same case is refused, however much the Card has left. The Card limits how much; it cannot make an action valid that the case’s state forbids;
  • an agent with no Card for this job is refused with no_mandate_issued. The job requires a Card, so nothing runs by default.

Your system asks KIFF before it issues the credit, with kiff-guard or the decision API, and runs it only on allowed. Where you see it: the Card’s History → Decisions, and refusals on Activity.

A number of plan changes a day, refused past it

A billing agent moves active subscriptions to another plan. The owner issues a Card for the job Change subscription plans and sets what happens past the limit to Stop:

billing-agent may CHANGE_PLAN
up to 40 plan changes a day
past that: Stop (refuse it)
  • The domain allows a plan change only on an ACTIVE subscription; a cancelled one is refused.
  • The 41st plan change today is refused with mandate_limit_reached, and the agent is told why. Nothing is held and nobody is asked.
  • A count limit counts each authorized attempt by default. A change the billing system then rejects still counts.
  • The day starts again at midnight in the Card’s time zone (Limits, warnings and extra room).

Start a new agent small

A team wants to try a new model on refunds without risking much. It connects the new agent with its own key or sign-in and gives it its own Card with a low limit, for example 50 EUR a day. The agent already doing refunds keeps its Card.

  • The new agent’s draws are on its own statement, apart from the other agent’s.
  • If the new Card uses more than half of a limit in the first tenth of its window, during its first week, KIFF sends a notice on Needs you and by email. The notice does not stop anything.
  • When the statement looks right, the owner raises the limit with Limits on the Card. Draws already counted still count, and the change is recorded with who made it.

Two agents, one budget

Two agents work the same queue and should share one daily budget rather than each having their own. The owner opens Share on the Card and names the second agent (up to 20 agents can share a Card).

  • Both draw on the same totals. A refund by one leaves less for the other.
  • Each decision still names the agent that asked.
  • Through the gateway, kiff_card shows each agent the same numbers, read at that moment.
  • Stop sharing with an agent, on the Card’s Share, removes one holder; the Card and its statement stay. Revoking the Card instead stops every holder.

Usually each agent has its own Card. Share one only when the budget really is common.

Stop one agent now

An agent starts doing something it should not. To stop that agent without stopping others:

  • Revoke its connections. Every gateway key and sign-in the agent uses is on Connections; its kiff-guard keys are on its Keys tab. Revoking one stops only that way in: if the agent has another key or sign-in, that one still works, so revoke each of them. The agent, its Cards and its history stay, so it can be connected again later.
  • Revoke its Card, if only this agent holds it. Calls that needed it are refused, unless another of the agent’s Cards covers them. Its statement stays readable.
  • Take it off a shared Card. Revoking a shared Card stops every agent that holds it. To stop just one, open Share on the Card and choose Stop sharing with that agent; the others keep the Card.

Next

← Quickstart kiff-guard on GitHub ↗