What UiPath agentic automation is, and which parts hold the controls
UiPath agentic automation is the positioning UiPath moved to at its FUSION conference in September 2025: one platform that coordinates AI agents, traditional RPA robots and human approvers in the same process. Three pieces matter when you are working out what governs spending.
UiPath Agents are the LLM-driven workers. They are built in Agent Builder, they call tools, and they are metered in Agent Units. UiPath Maestro is the orchestration layer that sequences agents, robots, external systems and human decisions into one long-running process. UiPath governance is the policy layer that evaluates what an agent is about to do and returns a verdict.
Most write-ups stop at the marketing description. We wanted the field list, because a control you cannot name in an API is a control you do not have. UiPath publishes two SDKs openly, so the field list is available to anyone who downloads them.
We measured both UiPath SDKs: 1,830 property names, zero money fields
On 23 September 2026 we downloaded the two SDKs UiPath publishes to public package registries, with no account and no authentication: @uipath/uipath-typescript 1.7.2 from npm (published 18 September 2026, 10.8 MB unpacked across 84 files) and uipath 2.14.25 from PyPI, released at 08:07 UTC on the morning of the probe itself, the 675th release of that package.
The TypeScript SDK's root type file is 843,143 bytes and declares 938 types with 2,787 property declarations, of which 1,157 are distinct property names. We ran a money regex across all of them: amount, currency, budget, spend, price, cost, payment, invoice, monetary, dollar, purchase, usd, billing, charge, fee, wallet, card. It returned three hits, and all three are false positives on the letters "fee": feedId, feedbackCategories and feedbackRating. There is not one genuine money property in the SDK.
The Python SDK agreed independently. Across 192 files it declares 673 distinct field names, and the same regex returned two hits, both false positives again: cached_agent_card (the A2A Agent Card, not a payment card) and max_llm_concurrency, which matches only because the word "concurrency" ends in "currency".
The check UiPath calls "budget" counts tool calls, not dollars
This is the finding that matters, and it is the reason a keyword search is not enough. UiPath's Python SDK ships the actual policy compiler at uipath/_cli/_governance/yaml_index.py, 532 lines that turn a YAML policy pack into a runtime policy index. It supports 11 check types: regex, tool_allowlist, parameter_validation, rate_limit, field_regex, data_quality_score, incident_taxonomy, commitment_extractor, sentiment_concern, guardrail_fallback, and one called budget.
Read the builder for that check and it has exactly three settings:
max_tool_calls_per_sessionmax_tool_calls_per_minutemax_consecutive_tool_calls
All three count calls. The denial message the compiler attaches is, word for word, "Tool budget exceeded". The neighboring rate_limit check is the same idea for the model: max_llm_calls_per_session and max_llm_calls_per_minute.
So UiPath's budget is a call counter. Given how UiPath bills, that is a defensible design, and we say so below. It is simply not what a CFO means by a budget.
Five numeric fields, all per session, and no way to compare an amount
We then traced every field a UiPath policy condition can actually test. There are exactly five numeric state fields in the entire policy language, and every one of them is a count of calls: session_state.tool_calls, session_state.tool_calls_per_minute, session_state.consecutive_tool_calls, session_state.llm_calls and session_state.llm_calls_per_minute.
Two structural consequences follow, and neither is a matter of opinion.
First, everything is session_state. No cumulative, daily, weekly or monthly counter exists anywhere in the compiler. Every new session starts back at zero, which is the same structural limit we found in AWS Bedrock AgentCore, where the one spend ceiling resets per session. A cap of 50 tool calls per session is not a cap of 50 tool calls a month.
Second, and more decisive, gt is the only numeric comparison operator in the language, and the compiler only ever binds it to those five counters. There is a check that reaches tool arguments, parameter_validation, but it can only apply a regex operator to tool_args, and its built-in message is "Suspicious pattern in tool parameters". A regular expression can look for a pattern in a string. It cannot express "greater than 1,000". So even though the amount an agent is about to pay sits right there in the tool arguments, no UiPath policy can compare it to a threshold.
One detail is worth reporting precisely, because it is the single place the word "amount" appears in the whole compiler. The commitment_extractor check has a flag called require_amount. It applies to the field model_output, and it tests whether the text the agent generated contains a commitment with a figure in it. It reads what the agent said. It has nothing to do with what the agent spent.
What UiPath does exceptionally well: it meters agents to the fraction of a unit
Credit where it is due, because the absence above is not incompetence. UiPath measures agent consumption in more detail than most vendors on this list. The TypeScript SDK's agents module exposes properties like consumedAGUQuantity and consumedPLTUQuantity (Agent Units and Platform Units), totalAGUConsumed, totalPLTUConsumed, agentUnitConsumption and platformUnitConsumption, broken out per folder, per process version, and split by whether the job completed.
The governance module is real too. GovernancePolicyTrace records, for every evaluation, which policy fired, the enforcement verdict, the actor identity, the actor process, the resource acted on and the distributed trace ID, and getOperationSummary returns allowedCount, deniedCount and noOpCount so you can see how often policies denied anything at all. The NoOp state is a simulated verdict, which means you can run a policy in observation mode before enforcing it. That is a mature design.
The policy engine can also do the thing most vendors skip entirely: it has four enforcement actions, ALLOW, DENY, AUDIT and ESCALATE, and the YAML keyword that maps to escalation is require_approval. UiPath can genuinely stop an agent and put a human in the loop, across six lifecycle hooks (before and after the agent, before and after the model, at the tool call and after the tool). The gap is not the mechanism. The gap is that the trigger cannot be an amount.
The finding holds up: two controls
An absence is only interesting if the method could have found a presence, so we ran two controls.
The positive control. We ran the identical money regex over the stripe npm package, version 22.6.2, across its 486 type files. It matched 376 of 2,493 distinct property names, or 15.1 percent: amount, amount_authorized, amount_capturable, amount_captured, amount_due and hundreds more. The regex is not blind. When a vendor models money, it lights up immediately.
The internal control. "It is a read-only SDK" would be an easy explanation for finding no controls, so we counted. The UiPath TypeScript SDK exposes 225 service operations across 26 modules, and 65 of them are writes. It can create and delete entities, assign roles, upload and delete files, stop and restart jobs, cancel Maestro processes and update user settings. It writes constantly.
The two modules that would need to carry a spend ceiling are the two that write nothing. The agents module has 10 operations and the governance module has 2, and every single one of those 12 begins with get. Every agents operation takes a startTime and an endTime, because every one of them is a report about a window that has already closed.
That is the sentence worth keeping: UiPath will tell you to the fraction of a unit what an agent consumed yesterday, and offers no call that tells an agent what it may not exceed tomorrow.
Why counting calls is reasonable for UiPath and still leaves you exposed
Here is the fair reading, and it explains the design rather than mocking it. UiPath bills agents per LLM call when the model is UiPath-hosted: 2 Agent Units per call on the Premium tier, 1 on Standard, 0.8 on Basic. If your bill is a function of call count, then capping call count caps your bill. UiPath's "budget" check is a sensible control over what the agent costs to run.
The exposure is that an agent has two ledgers, and UiPath only sees one.
The first ledger is platform consumption: Agent Units, Platform Units, the UiPath invoice. UiPath meters it precisely and gives you a call cap.
The second ledger is what the agent buys in the world: the purchase order it submits, the SaaS renewal it approves, the flight it books, the supplier it pays, the API it tops up. That money never appears in Agent Units, and no UiPath policy field can read it. An agent capped at 50 tool calls per session can submit a 40,000 dollar purchase order on call 12 and never trip a single check, because the amount is inside the tool arguments and the only operator that can touch tool arguments is a regex.
If your UiPath agents read data, draft documents and hand them to a human or to a business process that already has approval limits, you are covered and you should not buy anything else. If any agent holds a card, a wallet, a payment API or purchasing authority, the second ledger is unguarded, and that is what a per-agent spend policy is for: a budget denominated in dollars, a counterparty allowlist, an approval threshold that fires on the amount, and a cumulative limit that does not reset when the session does.
A rollout checklist for UiPath agents that can spend
- Split the two ledgers on paper first. List every agent and mark whether it can move money outside UiPath. Agents that only create documents inherit your existing approval chain. Agents with a card, wallet or payment API do not.
- Turn on the UiPath controls you already own. Set
max_tool_calls_per_sessionandmax_llm_calls_per_sessionon every production agent. They are free, they cap your Agent Unit bill, and they limit blast radius during a loop. - Run policies in NoOp first. Use the simulated verdict and read
deniedCountfromgetOperationSummarybefore you enforce, so you learn what a policy would have blocked without breaking a live process. - Use
require_approvalfor the irreversible steps. UiPath can escalate to a human at the tool call. Wire it to the tools that pay, transfer or commit, even though you cannot key it to an amount. - Add a dollar ceiling outside UiPath. Give each agent a funded wallet or a virtual card with a real monthly limit, lock it to the merchants it is allowed to use, and require approval above a threshold you set in dollars. That is the control the five session counters cannot express.
- Reconcile both ledgers monthly. Pull
getUnitConsumptionSummaryfor the UiPath side and your card or wallet statement for the other, per agent, so cost per outcome is a number you can defend.
AgentsPay is built for step five. Each agent gets its own wallet and scoped virtual card, a budget in dollars that is cumulative rather than per session, spend controls by merchant and category, approval thresholds that fire on the amount, and an audit trail of every authorization. It sits alongside UiPath rather than replacing anything: UiPath keeps governing what the agent does, and the wallet governs what it can pay.