GATE011: Financial capability exposed

The agent can move money: refunds, transfers, charges, payouts or subscription changes.

Name
Severity
Type
Critical
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
financial
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE011
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate classified a tool or grant as carrying the financial capability, creating refunds or charges, transferring funds, issuing payouts, modifying payment methods, or changing subscriptions.

Financial operations convert a software mistake directly into money leaving the company, and most of them are irreversible in practice even when they are technically reversible. They are also the highest-value target for prompt injection: an attacker who can put text in front of your agent and reach a refund tool has found a way to be paid.

There is no threshold at which an autonomous agent with an unattended payment capability is a good default. This rule is critical regardless of the amounts involved, because configuration does not tell Gate the amounts.

Example

This is the shape of configuration that triggers the rule.

// stripe.create_refund     -> financial, write
// stripe.create_payment_link -> financial, write

Remediation

Require human approval for every financial operation. Use a restricted API key scoped to the specific operations needed, set amount limits at the payment provider, and keep financial tools on a server that has no other capabilities, particularly not execution.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE011',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.