Budget Agent Tool Operations
Set per-task limits for tool calls, external spend, data volume, retries, and writes, then test loop stopping.
An agent can repeat a permitted tool call until it creates cost, load, or a large external effect. Authorization answers whether one action is allowed; a budget answers how many actions this task may perform. Both controls belong outside the model, which can miscount its own calls.
Choose budgets by operation class. A cheap cached read, an external API lookup, a message send, and a file export should not share one generic call limit. OWASP's LLM risk guidance includes excessive agency and unbounded consumption. Make the budget visible to the controller before it accepts work.
Task budget card
| Limit | Example decision |
|---|---|
| Tool calls | Maximum per task and per tool |
| External spend | Reserved ceiling before a provider call |
| Data volume | Rows, bytes, or documents returned |
| Time | Wall-clock expiry for the task |
| Writes | Separate count with approval per effect |
| Retry allowance | Fixed attempts, not an open loop |
Reserve the estimated cost before dispatch. Charge the observed result after a trusted receipt arrives. If the result is uncertain, keep the reservation until reconciliation rather than assuming a failed transport was free. Prevent concurrent workers from each spending the entire budget. When a budget is exhausted, stop new calls and return a partial, clearly marked result.
Loop test
In an owned mock, make a read tool return a result that tempts the agent to retry. Set a small call limit and confirm the controller stops at it. Test two concurrent tasks using the same account ceiling, a timeout after the upstream side effect, and a retry with the same request ID. Check the provider mock's actual call count, not just the agent transcript.
Keep normal tasks useful. A zero-call agent passes a cost test but fails the user's job. Run a positive control that completes within the limit. Record the limit owner, policy version, task class, and stop reason. High-impact actions still need authorization and approval even when a budget has room. A budget is a resource guard, not permission to contact a target or scan a public service.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.