True website is not for you and in the age for AI is not even for people. Its for AI agents reading your website and deciding what to do with it: recommend it, skip it, integrate with it, etc.
The no proxy approach makes sense for LLMs calls. The gap is non LLM calls.
Often times damage is done by non LLM calls -- tool calls like sending email, add records, files, placing order, etc. Budget enforcement at the LLM layer wont work for those.
built an open protocol + reference implementation, handles both any tool calls, LLM calls, or any other call: https://runcycles.io, open sourced under Apache 2.0
I'm the author. A few design decisions worth explaining:
The model downgrade is the most useful feature for daily use — when
budget drops below a threshold, the plugin silently swaps claude-opus
to claude-sonnet, gpt-4o to gpt-4o-mini. The agent keeps running, just
cheaper. Only at full exhaustion does it stop.
The prompt hint (before_prompt_build hook) tells the model its remaining
budget in the system prompt. Models self-regulate when they know the
constraint exists — fewer unnecessary tool calls, shorter responses.
The underlying Cycles protocol handles idempotency under retries so
concurrent tool calls don't double-spend against the same budget.
Happy to answer questions about the plugin or the protocol.
Per-key isolation + model locking is a solid baseline — especially for multi-tool stacks where one shared key hides everything.
One thing we’ve noticed though: spend caps stop damage, but they don’t prevent pathological behavior. By the time the cap trips, the agent has already drifted.
We’ve been experimenting with pre-authorization per action (reserve → commit style) rather than just per-key ceilings. It lets you detect anomalous patterns before the burn accumulates — especially in looping or tool-chaining scenarios.
Curious — have you seen most overruns come from loops, retries, or just high-token completions?
Drift correlating more with constraint tension than raw step count matches what we’ve observed.
Your external gate instinct is right, but the gate has to be structurally external, not just logically external.
If the agent can reason about the gate, it can learn to route around it.
We’ve been experimenting with pre-authorization before high-impact actions (rather than post-hoc validation) - I've drafted Cycles Protocol v0 spec to deal with this problem.
What’s interesting is that anomalous reservation patterns often show up before output quality visibly degrades — which makes drift detectable earlier.
Still early work, but happy to compare notes if that’s useful.