Per-key budgets, approved by email

Give every API key its own spending limit, and let your agents ask for more without ever raising their own cap. When an agent requests a bigger budget, you get an email — one click to approve or deny. Your agents run on their own; you stay the only one who can increase what they spend.