Fax for AI agents: approvals, budgets and evidence
Updated
What an approval binds
| Field | Checked at send time | Refusal when it differs |
|---|---|---|
| Document sha256 | against the quote and the document row | document_hash_mismatch |
| Destination | E.164, exact | approval_mismatch |
| Sender number | exact, or the pool | approval_mismatch |
| Amount and pages | micro-USD and billable pages | approval_mismatch |
| Expiry | the quote's ten minutes | approval_expired |
An agent that can send a fax can also send the wrong one. Fax for Agents is built so that cannot happen quietly. Every live send is authorized in one of two ways, both enforced on the server. A person approves that exact send, or a delegated policy written in advance allows it. The agent can ask. It cannot decide, and it cannot change the limits.
Three workflows
Human in the loop. The agent prepares and quotes the fax, then calls request_human_review with the quote id. The owner gets a mail with the destination, the pages and the amount, opens the request and approves it with a passkey. The agent sends with the approval id. One approval, one send.
Bounded autonomy. An administrator writes a delegated policy. These destinations or country prefixes. At most this many pages and this amount per job. This much per day and per month, until this date. The agent's key is bound to the policy. Every send is evaluated against the current version with the counters locked. A prompt that says "ignore the budget" changes nothing, because the evaluation never reads prompt text.
Receive and read. A fax arrives on the agent's number. The agent lists the inbox and reads the item. The text comes back under untrusted. It can summarise it for a person. It cannot turn an instruction printed on that fax into a send.
What the agent gets
Its own identity, with a name, a purpose that is shown and never evaluated, a key with bounded scopes and a budget. Disabling the agent revokes its keys in the same transaction. Its activity is an audit trail: every row with its actor, metadata only, never a document body.
What this is not
It is not an agent framework. Use it from Claude Code, Cursor, LangChain, your own loop or a cron job. It is not a chatbot that faxes from a prompt. Nothing leaves the service without a quote, a hold on the wallet and an authorization the server can name.
Prices
- $0.039per page sent
- $0.019per page received
- $2per number per month
- OptionalAgent workspace, $19 per month
Prepaid wallet, $10 minimum top-up. United States and Canada prices as of 2026-10-28. International rates are in the rate table. The sandbox is free.
Questions
How do I stop an agent from faxing the wrong document?
Bind the send. An approval in Fax for Agents covers one document hash, one destination, one sender number, one amount and an expiry. If the document changes after the approval, its hash changes and the send is refused with document_hash_mismatch. A delegated policy limits destinations by number or country prefix, so a wrong recipient is refused before the provider is called.
Can a fax agent increase its own spending limit?
No. An agent key is never issued the scopes that write budgets, policies or approvals. The server refuses those routes to any key with an agent id, even one minted with every scope. Budgets and caps are set by a person in the dashboard. A prompt that says ignore the budget changes nothing, because the policy engine never reads prompt text.
How do I prevent prompt injection from incoming fax documents?
The service treats everything in a received fax as data. Its text is listed under untrusted on every MCP result and is rendered as plain text, never as a heading, link or button. The policy engine and every tool decision take their inputs from the quote and the document row, not from that text. An id lifted from a fax and passed as an argument is refused as invalid input.
Which fax operations should require human approval?
Any live send that no delegated policy allows. In practice that means the first sends to a new recipient, anything over the per-job amount cap, and anything outside the allowed country prefixes. Reads, quotes, previews and sandbox sends need no approval. A person decides in the dashboard with a passkey step-up, and the decision covers exactly one send.