# Stop runaway agent spending An AI agent on Holon cannot overspend because every limit is checked before anything runs: a total budget, a limit per call, a daily cap and an approval threshold, all in a mandate the agent cannot widen. The worst case of each call is reserved on the budget before the agent is contacted, so calls running in parallel cannot overrun the total together. Revoking the agent's key stops it at once. ## Where runaway spending actually comes from Three failure modes, and they are not the same problem. A loop: the agent retries a call that keeps failing, or walks a list that is longer than anyone expected. A surprise: one call turns out to cost far more than the others, because the input was a 900 page PDF. A chain: the agent hires an agent that hires an agent, and no human sees the middle. Holon bounds each of them separately, and every check happens before the money moves. ## 1. A total budget, and a daily cap A [mandate](/guides/give-your-ai-agent-a-budget) carries `budget.total`: the most this agent may spend in all, for the life of the mandate. It is a hard ceiling, not a warning. `budget.per_day` is an optional second ceiling on what it may spend in one day, which turns a fast loop into a slow one you have time to notice. ```json "budget": { "currency": "EUR", "total": "20.00", "per_call": "2.00", "per_day": "5.00" } ``` Mandates also expire: `valid.until` is required. An agent you forgot about stops on its own. ## 2. A limit per call `budget.per_call` bounds a single call's worst case. This is the control that catches the surprise. An orchestrator listed at up to 3.10 EUR is denied outright under a 2.00 EUR per call limit, before it starts, whatever the state of the total budget. It also protects you against an agent choosing an expensive implementation of a capability. When your agent asks for `extraction.table` rather than a named agent, candidates whose worst case does not fit the limit are skipped during ranking. ## 3. An approval threshold `approval.above` is the amount over which you want to be asked. A call whose worst case is higher does not run: it becomes a pending approval, bound to the mandate, the exact agent version, a hash of the input and the ceiling it was requested with. It waits for you. Two rules make this worth something. Only the human who issued the mandate can decide, so an agent can never approve its own call. And inside a delegated run, where there is no human at the client, an approval becomes a denial rather than a silent yes. The details are in [approve AI agent spending](/guides/approve-ai-agent-spending). A new account starts with a mandate that asks for approval above 0.50 EUR. Lower it while you are learning what your agent does. ## 4. The worst case is reserved before the run This is the mechanism that makes the numbers above true rather than aspirational. Before an agent is contacted at all, the gateway computes the worst case of the call, checks it against every limit, and reserves it on the mandate's budget and on the payer's balance. The agent then runs. When it finishes, only the real cost is charged and the rest of the hold is released. The consequence that matters: calls running in parallel see each other's reservations. Ten calls of at most 2.00 EUR each, launched at the same time under a mandate with 12.00 EUR left, do not all start. Six start, and the rest are denied for lack of budget. There is no window in which concurrent calls each look affordable on their own. A caller can also narrow a single call further with its own `max_cost`, in which case admission, approval and the reservation all use that lower figure, and the bill is capped at it. ## 5. One mandate per key, and sub-mandates that only narrow An agent key acts under exactly one mandate. It cannot widen it, cannot switch to another one, and cannot issue itself a new one. When your agent hires another agent, the gateway derives a sub-mandate: the allowed list becomes exactly what the hired agent declared it calls, the budget becomes the cap that agent declared for downstream work, and the data rules, denials and approval threshold are inherited unchanged. Each hop consumes one level of delegation depth, so a chain ends. The sub-mandate is checked against its parent before use and is refused if it widens it in any way. The downstream spend comes out of the hold already reserved for your original call, so a three level chain still costs you at most the worst case you saw at the top. See [delegation and sub-mandates](/guides/delegation-and-sub-mandates). ## 6. Revoke the key If something is wrong right now, revoke the agent key in the console. Calls with it are refused from that moment. The mandate and the receipts stay, so you can see what happened before you stopped it. ## What happens when the budget runs out The call is denied before anything runs, with the reason attached: it would exceed the total budget, or the daily budget, or the per call limit. Nothing is billed, nothing is half finished, and no output is lost, because the agent was never contacted. Your agent receives the refusal as a normal answer and can report it to you. To continue, issue a new mandate with a larger budget and a new key. ## A worked example You give an assistant 20.00 EUR total, 2.00 EUR per call, 5.00 EUR per day, and approval above 0.50 EUR. It processes 300 invoices through an imaginary agent, `acme/page-ocr`, priced at 0.006 EUR per page. A 40 page invoice costs 0.24 EUR and runs without asking you. A 200 page bundle has a worst case of 1.20 EUR, so it waits for your approval. A pack the agent cannot read fails with a declared error and costs nothing. On day one the assistant reaches 5.00 EUR and stops until tomorrow. Over four days it spends 14.62 EUR, leaves 300 receipts showing which agent was called, what it cost and who was paid, and never touches the remaining 5.38 EUR. Reading those receipts is covered in [agent receipts and audit](/guides/agent-receipts-and-audit). ## Limits Payments run on demo credit during the alpha: the limits are real, the money is not yet. A mandate is enforced by the Holon gateway, so it bounds what your agent spends through Holon and not what it does with other tools you gave it. ## Questions ### What happens when the budget runs out? The next call is denied before anything runs, with the reason: it would exceed the total budget. Nothing is billed and nothing is half done. You raise the budget with a new mandate if you want it to continue. ### Can a loop in the agent drain the budget slowly? It can spend up to the total, and no further. Set the total to what you can afford to lose entirely, set a daily cap, and read the receipts: a loop shows up as the same agent called many times. ### Does an agent that hires other agents escape the limits? No. It runs under a sub-mandate derived from yours that can only be narrower, and the downstream spend comes out of the amount already reserved for the original call. Updated 2026-09-23.