Hard budget caps stop the bill. They count projects, not agents

Published October 7, 2026 · Last reviewed October 16, 2026

On May 9, 2026 an AI agent opened an issue on the DN42 hobbyist network’s Git forge. It introduced itself as a friendly AI agent whose user wanted it registered so it could index the network. It held AWS credentials. To do the job it launched five m8g.12xlarge instances with load balancers and, by the operator’s later account, reapplied its CloudFormation template more than once, duplicating the stack. The operator found out about a day later from charges on a card; the AWS bill was $6,531.30. AWS later cut it to $1,894, again by the operator’s account. The workload, by community estimates, would have fit on a $5-a-month server.¹²

The agent had a name, a stated purpose and a principal, all written in public on DN42’s forge. The bill had a credential.

On October 3, 2026, Simon Willison wrote that pay-by-usage services are going to need hard budget caps on by default: past a configured amount, cut the service off and return errors, because coding agents make it easy to start something that keeps charging.³ The Hacker News thread reached 642 points and 311 comments by October 7.⁴ Caps that refuse are now real at the AI API providers and, since July and September, at Google Cloud and AWS, the latter still rolling out to new customers. They stop the bill, they leak in ways their own documentation describes, and every one of them is drawn around a billing container. None knows which agent spent the money, who authorized it, or who it was dealing with.

What a hard cap is, and who already ships one

Willison’s post is an argument, not an incident study. His line is between two features. A soft cap sends a warning email at a threshold, and in his view that is not enough. A hard cap returns errors. He wants the hard kind as the default, with removal behind a checkbox in which the customer accepts responsibility for every charge that follows.³ He adds one request aimed at agents themselves: that they start recommending providers with hard caps and warn new builders off uncapped ones.

The AI API layer got there first. Anthropic’s Start, Build and Scale usage tiers each carry a monthly spend cap ($500, $1,000 and $200,000), and reaching it pauses API usage until 00:00 UTC on the first of the next month, with requests answered by HTTP 429.⁵ That is a hard cap on by default, close to Willison’s design, except that the customer raises it by moving tiers or asking rather than ticking a box. OpenAI added hard spend limits for organizations and projects on July 22, 2026; they are optional, and without the “Enforce a hard limit” setting a limit only sends alerts.⁶⁷ Google’s Gemini API enforces tier caps at the billing-account level, $250 a month on Tier 1, and offers experimental per-project caps on top.⁸

The clouds came late, and Willison’s post is partly a reaction to their arrival. Google Cloud put spend cap budgets into Preview on July 27, 2026.⁹ Each cap covers one project and one eligible service, and four services are eligible: the Gemini API, Gemini Enterprise Agent Platform (formerly Vertex AI), Cloud Run and Cloud Run functions. When estimated spend reaches the cap, new usage of that service in that project is paused until someone lifts the cap or the next month begins.¹⁰

AWS arrived through onboarding. The builder experience it announced on September 16, 2026 organizes work into projects, and a project on a paid plan can carry a monthly spend limit.¹¹ The limit is optional and set by the project owner, with a minimum of $20 or a conservative estimate of likely spend, whichever is greater. AWS sends notices at 50, 75 and 90 percent, or when spend is on track to reach the limit within ten days, then pauses the project and stops all its resources. Raising the limit reactivates it. Untouched for 90 days, the project’s data is permanently deleted. Both documentation pages say the experience is still releasing to a limited number of customers, and the rollout covers new AWS accounts only.¹²¹³

The stop has its own failure modes

OpenAI, Google and AWS each document where their stop leaks, and the disclosures are worth more than the launch posts.

Enforcement is never instant. OpenAI says recorded spend can slightly exceed a hard limit because enforcement is not instantaneous.⁶ Google Cloud says the same about spend caps and bills the overage as normal; requests already in flight run to completion and accrue charges.¹⁰ The Gemini API’s project caps lag around ten minutes, and Google’s billing page names the case this article is about: “agent sessions may incur overages beyond your project spend cap.”⁸ A cap is a brake with a reaction time. For an agent looping against a metered endpoint, the reaction time is the exposure.

Scope is narrower than the name. Google Cloud’s caps cover four services, exclude subscription costs, folders, organizations and labels, and do not pause persistent resources such as compute and storage, which keep billing while the project sits at its cap. An enforced cap also lifts itself at the start of the next budget period.¹⁰ An agent left running on the 30th resumes on the 1st.

AWS makes the opposite trade. The stop works by taking the project down: every resource stopped, some needing a manual restart, and a 90-day clock on the data. AWS’s own guidance is that spend limits are designed for experimentation, learning and sandbox workloads, usable in production only where a brief pause is acceptable.¹² Help Net Security noted that what a halted project does to a live public endpoint is not spelled out.¹³ Removing the limit has a cost too: AWS then stops monitoring the project’s costs and applying its early cost controls.¹²

The objection Willison anticipated came up in the thread in different words. One commenter wrote that most enterprise users “would much rather have overages in billing than outages.”⁴ OpenAI’s documentation concedes the point: hard limits can interrupt production traffic.⁶

So the honest choice is not safety versus risk. It is a bounded bill with an outage, or an unbounded bill with nothing watching. Willison’s default, a cap you have to deliberately accept liability to remove, picks the first as the starting position, and for anything an agent spun up on its own that looks right. Several of these features are in Preview, experimental or limited release. Re-read the current pages before a design leans on one.

A cap counts containers, not agents

Every cap above attaches to a billing container. Anthropic caps an organization and lets you set lower limits per workspace.⁵ OpenAI caps an organization or a project.⁶ Google Cloud caps a service inside a project; on the Gemini API, every key in a project counts toward the same project cap.¹⁰⁸ AWS caps a project.¹² None is measured in agents, because billing has always been scoped to whatever pays.

That becomes a gap the moment more than one agent shares a container. Two coding agents, a nightly job and a personal assistant in one project share one ceiling. When it trips, the signal is that a number was reached. The cap cannot say which of the four reached it, what it was doing, or on whose instruction, and the pause lands on all four. The one that misbehaved and the three that were working stop together.

The cheap fix is to make the container the agent. One project per agent where caps are project-scoped, one workspace per agent at Anthropic. A key per agent is not enough on the Gemini API, where keys share their project’s cap.⁸ Then the limit tells you something when it trips, and the pause stops only the agent that caused it.

Some providers have started cutting closer. Anthropic’s Managed Agents, in beta, let a developer set a session budget: an optional hard dollar ceiling on a single agent session, enforced by the platform.¹⁴ That bounds one run, not one agent across its life, but among the usage-billing caps surveyed here it is the only one scoped to agent activity rather than an account. Payment rails scope some caps per agent too, as below. On the reporting side, AWS has let Bedrock customers allocate model costs by IAM user and role since April 9, 2026, so a role per agent shows up in the cost report.¹⁵ It is attribution after the fact, with no enforcement attached.

Even then, the label is one you chose. A project named after an agent, a role tagged with its name, a session ID: each says which container spent the money, and the mapping from container to agent is the operator’s own bookkeeping. The DN42 agent told the network who it was and who it worked for. Nothing in AWS’s billing would have said so.

Payment rails have been answering a different question, authority per action. Stripe’s Link wallet still makes a person approve each amount, and approve again to raise it. Coinbase gave an agent its own isolated portfolio to trade from, and Circle’s agent wallets carry owner-set caps per wallet. Those settle whether this agent may do this thing now. A cap settles how much in total. Neither settles what an operator needs after an incident: which agent, acting for which person, under which grant, against which counterparty.

Four boundaries that look like one

Budget caps get discussed as agent safety, and that is where the categories blur. Four questions are in play, each with its own mechanism, and a control that answers one answers none of the others.

How much can be spent in total. A provider cap, enforced. It bounds financial liability and nothing else.

Whether this agent may take this action at all. Per-action approval and scoped grants: a person approving an amount, an isolated portfolio, a delegation record, or AP2-style mandates. Policy fixed at deployment belongs here too, which is the distinction behind where an agent’s policy boundary sits. An agent can stay well inside its budget while doing something nobody authorized.

Who was on the other side. The counterparty question, with the least infrastructure behind it. Web Bot Auth signatures tell a site which agent is calling; ERC-8004’s on-chain reputation registries already show Sybil patterns in the data. Neither gives the operator a record of which business its agent dealt with. When OpenAI’s agents uploaded user images to third-party hosts, the gap was that nothing routed back to the people involved.

Whether two humans agreed to be introduced. A different kind of permission, because it concerns people rather than resources. It is the argument for mutual reveal in agent networks.

Run DN42 through all four. A cap like AWS’s could have bounded the loss, if the operator had been on the new project model and the cap had tripped in time; InfoQ notes cloud billing data can lag about a day, roughly how long the incident ran.² Even a cap that worked would not have recorded that the agent first asked DN42’s administrators to register it on the operator’s behalf, that it took a volunteer network as its counterparty, or that the people running that network never agreed to be scanned. Those facts exist only because the people on the other side wrote them down.

That is why a cap is a good default and a poor safety story. It is the one control that works while you sleep, which is the property Willison was arguing for.³ It also has the least to say the next morning.

How this connects to Tobira

Tobira works on the fourth boundary, and it is worth being exact about which one. Tobira is not a budget limiter, and an @handle will not stop an agent from burning a month of API spend; put the cap on the project. What Tobira addresses is the part no provider setting covers: an @handle gives the person or company behind an agent an address a human can read and another agent can look up, a Site Agent makes a company website agent-addressable and networked so a visiting agent can ask questions and reach its owner, and mutual reveal means contact details move only after both humans agree. Claiming a @handle on Tobira is free, and the network had 729 agents per Tobira internal data, September 2026. Tobira Site Agent has a free plan on your own AI key and paid plans from $49 a month (as listed on tobira.ai/agentic-site/ on 16 October 2026). DN42’s volunteers knew exactly who was knocking, because the agent told them. Most sites will not be that lucky.

What to remember

• On October 3, 2026 Simon Willison argued that usage-priced services should ship with hard budget caps on by default, with removal an explicit opt-in. The Hacker News thread reached 642 points by October 7.³⁴
• Hard caps already exist. Anthropic’s API tiers cap monthly spend by default; OpenAI added optional hard limits on July 22, 2026; Google Cloud spend caps reached Preview on July 27; AWS added optional project spend limits on September 16, still rolling out to new customers.⁵⁷⁹¹¹
• Most leak, by their own documentation. OpenAI and Google say enforcement lags and overages are billed, Google says agent sessions can run past a Gemini API project cap, persistent resources keep billing, and AWS stops the whole project with a 90-day deletion clock.⁶⁸¹⁰¹²
• Caps attach to an organization, project, workspace, service or session, never to an agent. One container per agent makes the cap a per-agent boundary; the mapping is still yours.
• Spend limits, action authorization, counterparty identity and consent between humans are four separate records. A working cap answers the first.

Frequently asked questions

What is a hard budget cap, and how is it different from a billing alert?

A hard cap stops the service once spending reaches the configured amount, so further requests fail instead of adding charges. A billing alert only notifies you, usually after the money is spent. Simon Willison argued on October 3, 2026 that usage-priced services should ship with hard caps on by default, with removal an explicit opt-in.³

Which providers enforce a hard spending cap in 2026?

Anthropic’s API tiers carry a monthly spend cap by default and pause usage when it is reached. OpenAI added optional hard limits for organizations and projects on July 22, 2026. Google Cloud put spend cap budgets into Preview on July 27, 2026 for four services, including the Gemini API and Cloud Run, and the Gemini API also has tier and project caps. AWS added optional project spend limits to the builder experience announced on September 16, 2026, still rolling out to new customers.^5791081112

Will a spend cap stop an AI agent from running up a bill?

It bounds the bill rather than stopping the behavior, and not exactly. OpenAI and Google say enforcement is not instantaneous and overages are billed; Google says agent sessions may run past a Gemini API project cap; Google Cloud caps do not pause persistent compute and storage. AWS pauses the whole project and deletes its data after 90 days without action.⁶¹⁰⁸¹²

Can a budget cap tell me which agent spent the money?

Only if you made each agent its own billing container. Caps attach to an organization, project, workspace, service or session. One project or workspace per agent turns the cap into a per-agent boundary, and Anthropic’s Managed Agents session budgets (beta) cap a single run. AWS can attribute Bedrock costs to the IAM role that made the call, after the fact. The label is still one you chose.¹⁴¹⁵

What does a spending limit not cover?

Three questions it was never designed for: whether the agent was authorized to take the action, who the counterparty on the other side was, and whether the humans involved agreed to the relationship. Each needs its own record. A cap bounds financial liability only.

Sources

Provider pages were read directly on October 7, 2026. Several of the features described are in Preview, beta, experimental status or limited release, and their documentation changes; figures are attributed to the party that published them.