The first time an agent loops on a flaky tool and retries two hundred times, the bill teaches a lesson that no dashboard could. Spend caps are how you learn it the cheap way.
A spend cap is a hard number: the maximum dollars an agent may consume in a day, or in a month, before the authorization layer starts refusing new work. Not an alert. Not a report you read Monday morning. A refusal — evaluated on every call, before the cost is incurred.
Caps are per agent, not per account
An account-level ceiling tells you the fleet is expensive. It doesn't tell you which agent is expensive, and it doesn't stop that agent without stopping everything else. Per-agent caps do both:
- Daily caps bound the blast radius of a single bad day. A research agent that normally spends $0.40/day gets a $3 daily cap. A runaway loop hits the wall in hours, not days.
- Monthly caps bound the bill. Size them from the daily cap: daily × 31 × a headroom factor of 1.5–2, so one heavy day doesn't kill the month.
Size from observed spend, not from optimism
The sizing method that works in production:
- Measure for two weeks with no enforcement — log every call's estimated cost. You need the 95th-percentile daily spend per agent, not the average. Averages hide the days that matter.
- Set the daily cap at 3–5× the p95. Tight enough to catch a loop (loops spend 10–100× normal), loose enough that a legitimately busy day passes.
- Set the monthly cap at 40–60× the p95 daily. This absorbs variance while still bounding total exposure.
New agents with no history get a deliberately small cap — $5/day is a fine default — and earn headroom as their spend pattern stabilizes.
Alerts are early warnings, not the control
Alert at 80% of each cap. The alert's job is to give you time to investigate or raise the cap deliberately; the cap's job is to fire when you don't. Teams that implement only alerts invariably find that everyone sleeps through the 80% ping on the one night it matters.
Estimate cost at decision time
The gateway can't price a call it hasn't seen. Feed it an estimated_cost with every authorization request — token counts × model price for LLM calls, fixed prices for tool calls — and let the policy layer sum estimates against the cap. Estimates are approximate; the control still works because loops are orders of magnitude off normal, not percentages.
What caps don't do
Caps bound dollars, not damage. A single delete_production_database call costs pennies and is worth more than any bill. That's what action policies and human approvals are for — caps handle the spend, allowlists handle the blast radius.