Module XI (Cost and AI FinOps) accounts AI spend from the provider cost stream and enforces budgets. At the cap, a budget gate denies the spend. This is live enforcement, always wired in the default binary — not an on-demand feature you provision later. If a budget is configured, the gate is live.
Budget gates
A budget gate has two enforcement modes:
- Throttle — rate-limits the spend, degrading gracefully. The agent is slowed, not stopped outright, until the budget recovers or an operator raises it.
- Block — hard deny at the cap. The agent receives a clear signal that its budget is exhausted and no further spend is authorized.
Both modes are deny-closed: if the budget state is unreadable — a store error, a corrupted row, a missing record — the gate denies, never permits. An unknown budget state is treated as exhausted, not as unlimited. This is the same posture the rest of the platform holds for enforcement gates (see governance).
Cost accounting
Spend is derived from the provider cost stream and operator-verified reference pricing managed by Module X (Model and provider management). Cost samples come from observed telemetry — the tokens, the model, the provider — not from intercepting API calls. The platform does not sit in the inference path; it reads the cost signal out of band, the same way it reads every other observation.
Reference pricing is operator-verified, not fabricated. Module X lets you declare the per-token or per-request price for each model and provider, and budget enforcement uses that pricing as the accounting basis. If the declared price diverges from what the provider actually charges, the budget gate enforces against the declared price — the platform cannot know the provider’s invoice until the provider reports it.
Setting up a budget
Budgets scope to three levels:
- Per-tenant — a ceiling for all AI spend within a tenant.
- Per-agent — a ceiling for a single agent’s spend, within its tenant.
- Per-model — a ceiling for spend on a specific model, within a tenant or agent.
Enforcement is immediate. Once a budget is configured with a cap and a gate mode (throttle or block), the gate is live. There is no warm-up, no delay, no “enforcement will begin after the next billing cycle.” The gate checks the accumulated spend against the cap on every governed cost event.
Budget scopes compose by intersection: a per-agent budget and a per-tenant budget both apply, and the first cap reached triggers its gate. A per-model budget within an agent is further-restricted by any per-agent and per-tenant budgets above it.
What happens at the cap
When accumulated spend reaches or exceeds the configured cap:
- The budget gate denies the spend — throttle or block, depending on the mode.
- The denial is recorded as a finding in the platform’s findings surface, with the budget scope, the cap, and the accumulated spend at the time of denial.
- The agent receives a clear signal that its budget is exhausted. The platform does not silently drop the request or return an ambiguous error.
- If notifications are configured, the denial routes through Module XV.
A denied spend is a governed event. It is written to the audit ledger in the same transaction as the denial, so there is no window where a budget denial is unrecorded.
Notifications
Budget alerts integrate with Module XV (Output integrations and notifications). When a budget approaches or hits its cap, the finding can route to any configured destination:
- Slack / Teams — channel or DM notification.
- PagerDuty / Opsgenie — alert escalation.
- Signed webhook — for custom integrations.
- SIEM — appended to the audit export stream.
Notification destinations are operator-provisioned. A budget gate enforces regardless of whether a notification destination is configured — the gate is the enforcement, the notification is the awareness layer.
The kill switch interaction
The kill switch is the estate-wide deny gate and it overrides everything, including budget gates. When the kill switch is engaged:
- All governed actuation is denied, including any spend that budget gates would otherwise throttle or allow.
- A budget gate’s throttle/block mode is moot — the estate is stopped.
- Re-enabling the estate requires the usual dual-control approval (two distinct humans, no break-glass path for re-enable).
The budget gate and the kill switch are independent controls. They compose, not compete: the kill switch is a superset deny that subsumes every other gate.
Model routing and budget
Module X handles model routing with operator-verified reference pricing. Budget enforcement consumes this pricing — it does not maintain its own price table or fabricate cost data. The dependency is one-directional:
- Module X declares the model catalog and reference prices.
- Module XI reads those prices to account spend and enforce budget caps.
If Module X has no reference price for a model, Module XI cannot account the spend against a budget. Ungoverned spend (no price, no budget) is surfaced as a finding, not silently passed.
Honest limits
Budget enforcement is live and deny-closed for the surfaces the platform governs, but it has limits you should understand before relying on it:
- Cost accuracy depends on the provider. The platform accounts spend using operator-declared reference pricing and observed token counts. If the provider’s actual billing differs from the declared price, the budget gate enforces against the declared price, not the invoice. The platform does not fabricate cost data or invent benchmarks.
- Coverage is bounded by observation. Budget enforcement applies to spend that flows through governed channels — sources the platform observes. An agent that calls a model through an ungoverned path (no source wired, no telemetry emitted) is invisible to the budget gate. The platform surfaces ungoverned paths as findings when it can detect them, but it cannot enforce on what it cannot see.
- The platform is pre-1.0. Budget enforcement ships and is wired today, but treat the accounting detail as work in progress. See honesty and limits for the full posture.
Related
- Modules catalog — Module XI (Cost and AI FinOps) and Module X (Model and provider management).
- Governance — the deny-closed enforcement model budget gates follow.
- FinOps tour — the product page for cost governance.
- Kill switch — the estate-wide deny gate that overrides budget enforcement.
- Honesty & limits — what is live versus design-toward.