Track vendor spend
Finance sees a new third-party service before a dollar is spent, not after the invoice arrives.
How it works
When another coworker provisions a new service — a database, an API tier, a monitoring tool — it sends a mailbox message to Finance before spend is incurred. Finance logs a cost entry, checks it against a budget gate, and only then does the provisioning coworker proceed. The spend gate itself is the same gates.toml mechanism used everywhere else: match on the action, require = "operator", surface = "buddy".
Why it's a gate, not a report
A monthly spend report tells you what happened. A spend gate stops the wrong thing from happening — the approval is requested before the vendor is charged, on the same device where a legal send or an engineering deploy would be gated, so "did anyone approve this" is never a question asked after the fact.
Related
a283670b2493553d · verify