stigg-governance

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes budget-management operations: it defines "assignments" that set per-(entity,featureId|currencyId) usageLimits (assignment upsert) and documents using the MCP execute tool to call the SDK (e.g., client.v1Beta.customers.assignments.upsert). It also covers credit-based budgets (currencyId) and usage/entitlement reporting/checking (usage.report, events.report, customers.entitlements.check) which directly affect credit consumption and enforcement. This is equivalent to an API for updating budgets (the kind of "manage budget" action flagged in the policy), so it grants direct financial-execution authority for per-entity budgets.