Often times damage is done by non LLM calls -- tool calls like sending email, add records, files, placing order, etc. Budget enforcement at the LLM layer wont work for those.
built an open protocol + reference implementation, handles both any tool calls, LLM calls, or any other call: https://runcycles.io, open sourced under Apache 2.0
This means agents must follow this flow: reserve, use, commit or release.
Interesting how others are handling runaway agents, loops, etc, especially under concurrency.
Rate limits control velocity. They say nothing about what an agent is allowed to do next. An agent can pass every rate-limit check and still delete 400 records, send 200 emails, or place orders before anyone notices. The damage isn't always in the bill — it's in the consequence.Cycles is an open protocol for pre-execution enforcement. The core mechanism: reserve exposure before the action runs,...
The model downgrade is the most useful feature for daily use — when budget drops below a threshold, the plugin silently swaps claude-opus to claude-sonnet, gpt-4o to gpt-4o-mini. The agent keeps running, just cheaper. Only at full exhaustion does it stop.
The prompt hint (before_prompt_build hook) tells the model its remaining budget in the system prompt. Models self-regulate when they know the constraint exists — fewer unnecessary tool calls, shorter responses.
The underlying Cycles protocol handles idempotency under retries so concurrent tool calls don't double-spend against the same budget.
Happy to answer questions about the plugin or the protocol.
https://github.com/runcycles/cycles-openclaw-budget-guard
OpenClaw agents can loop, pick expensive models, and burn budget before anyone notices. This plugin stops that.Install: openclaw plugins install @runcycles/openclaw-budget-guard Add one config block with your tenant and optional model fallbacks (e.g. claude-opus → claude-sonnet when budget is low). The plugin handles the rest: balance checks before model selection, reservations before...
https://github.com/runcycles/cycles-runaway-demo
I built this after reading too many incident reports of agent loops spending $200 in 4 minutes because a quality threshold was never met.The pattern is always the same: an agent retries, fans out, or loops. Each iteration passes individual rate-limit checks. Observability fires an alert after the money is gone. Provider caps are per-provider, not cross-provider. None of these stop the spend...
One thing we’ve noticed though: spend caps stop damage, but they don’t prevent pathological behavior. By the time the cap trips, the agent has already drifted.
We’ve been experimenting with pre-authorization per action (reserve → commit style) rather than just per-key ceilings. It lets you detect anomalous patterns before the burn accumulates — especially in looping or tool-chaining scenarios.
Curious — have you seen most overruns come from loops, retries, or just high-token completions?
Your external gate instinct is right, but the gate has to be structurally external, not just logically external. If the agent can reason about the gate, it can learn to route around it.
We’ve been experimenting with pre-authorization before high-impact actions (rather than post-hoc validation) - I've drafted Cycles Protocol v0 spec to deal with this problem.
What’s interesting is that anomalous reservation patterns often show up before output quality visibly degrades — which makes drift detectable earlier.
Still early work, but happy to compare notes if that’s useful.