Consumer agent Pally caps purchases with single-use virtual cards; publishes no audit trail or insurance terms

Pally, a text-message-based AI assistant that connects to accounts including Gmail, WhatsApp, Slack, Google Calendar and GitHub, publishes specific controls on what its agent can spend and send without a human's sign-off, but discloses no audit trail, compliance certification, outcome-linked pricing or insurance covering its own conduct, according to AI Dispatch's index of agent assurance.

The company's site says a user's Pally completes purchases "with a single-use virtual card capped at exactly what you approved," and that anything leaving a user's connected accounts — a message, a purchase or a calendar invite — "is shown to you word-for-word and only happens after you say go." The product also treats incoming content defensively, a response to a known failure mode in agents that act on emails or web pages: "anything from outside your world is treated as information to read, never instructions to act on."

Those disclosures earned Pally a 2 out of 3 on AI Dispatch's runtime-governance dimension, which measures whether spend, scope and authority are enforced at the moment an agent acts, rather than promised in a policy document. It fell short of a 3 because the limits are self-attested: Pally publishes no audit record a customer could check against them, and no third party has verified the controls hold during an actual run.

On the index's other four trust-gap dimensions, Pally scored zero. A full-text search of the 15,720-character capture AI Dispatch retrieved from pally.com found no mention of a compliance certification, an audit log, outcome-linked pricing or an insurance carrier covering the company's own liability. The page's single reference to "insurance" is a customer testimonial about a user's personal car-insurance renewal, not coverage the company carries for its own performance.

Pally bills a flat monthly subscription — $25 a month, or $250 a year on its "Pro" tier — charged whether or not a given task is completed to the user's satisfaction. The entity was added to AI Dispatch's index this week and published following a fact-check against the captured page.