HackerNews中文版

我很好奇大家在实际生产环境中是如何操作的，而不是在演示中。如果你正在运行自主或半自主的智能体，它们会：调用付费 API购买数据调用按量计费的工具在未经人工批准的情况下链式执行操作…你们是如何处理支付和限额的？我在实际应用中看到的大多是权宜之计：提供商级别的 API 密钥，带有硬性使用上限稍后重新计费的代理服务存在于侧分支中的特定于框架的黑客手段仅警报或手动批准模式或者干脆不允许智能体直接消费这些方法没有一个看起来像是干净的抽象，尤其是在智能体做出数千个微决策之后。困难的部分似乎不是“转移资金”，而是安全地授权支出：花多少钱花在什么地方在什么条件下以及如何撤销或审计框架可以理解地避免这个问题，但这使得每个团队都在重复发明相同的脆弱模式。所以我真心想问：你们今天是如何处理这个问题的？什么会出问题或让你感到不舒服？这个问题是还处于早期阶段，还是已经让你很头疼了？很想听听具体的设置——即使答案是“我们放弃了”。

查看原文

I’m curious how people are actually doing this in production, not in demos.If you’re running autonomous or semi-autonomous agents that:call paid APIspurchase datainvoke metered toolschain actions without human approval…how are you handling payments and limits?What I mostly see in the wild are workarounds:provider-level API keys with hard usage capsproxy services that re-bill laterframework-specific hacks living in side branchesalert-only or manual approval modesor simply not letting agents spend directlyNone of these feel like a clean abstraction, especially once agents make thousands of micro-decisions.The hard part doesn’t seem to be “moving money,” but delegating spending authority safely:how muchon whatunder what conditionsand how to revoke or audit itFrameworks understandably avoid this, but that leaves every team reinventing the same fragile patterns.So I’m genuinely asking:How are you handling this today?What breaks or feels uncomfortable?Is this problem still premature, or already painful for you?Would love to hear concrete setups — even if the answer is “we punted on it.”

人们如何处理自主智能体对付费外部 API 的使用？