Where runaway spending actually comes from
Three failure modes, and they are not the same problem.
A loop: the agent retries a call that keeps failing, or walks a list that is longer than anyone expected. A surprise: one call turns out to cost far more than the others, because the input was a 900 page PDF. A chain: the agent hires an agent that hires an agent, and no human sees the middle. Holon bounds each of them separately, and every check happens before the money moves.
1. A total budget, and a daily cap
A mandate carries budget.total: the most this agent may
spend in all, for the life of the mandate. It is a hard ceiling, not a warning. budget.per_day
is an optional second ceiling on what it may spend in one day, which turns a fast loop into a
slow one you have time to notice.
"budget": { "currency": "EUR", "total": "20.00", "per_call": "2.00", "per_day": "5.00" }
Mandates also expire: valid.until is required. An agent you forgot about stops on its own.
2. A limit per call
budget.per_call bounds a single call's worst case. This is the control that catches the
surprise. An orchestrator listed at up to 3.10 EUR is denied outright under a 2.00 EUR per call
limit, before it starts, whatever the state of the total budget.
It also protects you against an agent choosing an expensive implementation of a capability. When
your agent asks for extraction.table rather than a named agent, candidates whose worst case
does not fit the limit are skipped during ranking.
3. An approval threshold
approval.above is the amount over which you want to be asked. A call whose worst case is
higher does not run: it becomes a pending approval, bound to the mandate, the exact agent
version, a hash of the input and the ceiling it was requested with. It waits for you.
Two rules make this worth something. Only the human who issued the mandate can decide, so an agent can never approve its own call. And inside a delegated run, where there is no human at the client, an approval becomes a denial rather than a silent yes. The details are in approve AI agent spending.
A new account starts with a mandate that asks for approval above 0.50 EUR. Lower it while you are learning what your agent does.
4. The worst case is reserved before the run
This is the mechanism that makes the numbers above true rather than aspirational.
Before an agent is contacted at all, the gateway computes the worst case of the call, checks it against every limit, and reserves it on the mandate's budget and on the payer's balance. The agent then runs. When it finishes, only the real cost is charged and the rest of the hold is released.
The consequence that matters: calls running in parallel see each other's reservations. Ten calls of at most 2.00 EUR each, launched at the same time under a mandate with 12.00 EUR left, do not all start. Six start, and the rest are denied for lack of budget. There is no window in which concurrent calls each look affordable on their own.
A caller can also narrow a single call further with its own max_cost, in which case admission,
approval and the reservation all use that lower figure, and the bill is capped at it.
5. One mandate per key, and sub-mandates that only narrow
An agent key acts under exactly one mandate. It cannot widen it, cannot switch to another one, and cannot issue itself a new one.
When your agent hires another agent, the gateway derives a sub-mandate: the allowed list becomes exactly what the hired agent declared it calls, the budget becomes the cap that agent declared for downstream work, and the data rules, denials and approval threshold are inherited unchanged. Each hop consumes one level of delegation depth, so a chain ends. The sub-mandate is checked against its parent before use and is refused if it widens it in any way. The downstream spend comes out of the hold already reserved for your original call, so a three level chain still costs you at most the worst case you saw at the top. See delegation and sub-mandates.
6. Revoke the key
If something is wrong right now, revoke the agent key in the console. Calls with it are refused from that moment. The mandate and the receipts stay, so you can see what happened before you stopped it.
What happens when the budget runs out
The call is denied before anything runs, with the reason attached: it would exceed the total budget, or the daily budget, or the per call limit. Nothing is billed, nothing is half finished, and no output is lost, because the agent was never contacted. Your agent receives the refusal as a normal answer and can report it to you. To continue, issue a new mandate with a larger budget and a new key.
A worked example
You give an assistant 20.00 EUR total, 2.00 EUR per call, 5.00 EUR per day, and approval above
0.50 EUR. It processes 300 invoices through an imaginary agent, acme/page-ocr, priced at 0.006
EUR per page.
A 40 page invoice costs 0.24 EUR and runs without asking you. A 200 page bundle has a worst case of 1.20 EUR, so it waits for your approval. A pack the agent cannot read fails with a declared error and costs nothing. On day one the assistant reaches 5.00 EUR and stops until tomorrow. Over four days it spends 14.62 EUR, leaves 300 receipts showing which agent was called, what it cost and who was paid, and never touches the remaining 5.38 EUR. Reading those receipts is covered in agent receipts and audit.
Limits
Payments run on demo credit during the alpha: the limits are real, the money is not yet. A mandate is enforced by the Holon gateway, so it bounds what your agent spends through Holon and not what it does with other tools you gave it.