Price the whole task
Count model input and output usage, retrieval, paid tool calls, retries, human review, and infrastructure time. A cheap model call may start an expensive external search or trigger repeated large-context calls. Assign a budget by task class, not one global number for every request: summarizing a ticket and researching a complex incident have different value. Define a successful outcome and maximum acceptable cost per successful case. Anthropic's agent evaluation guide recommends tracking runtime, tool calls, token consumption, and errors alongside task success.
Set explicit stop rules
Limit total steps, repeated calls to the same tool, wall-clock duration, tokens or provider usage, and external spend. Set narrower limits for untrusted or low-value requests. A loop detector should recognize when the agent asks the same question with small wording changes. The OWASP agent security cheat sheet includes chain-depth, retry, token, and cost limits as controls against recursive tool abuse. Enforce limits in the orchestrator and tool gateway; a polite prompt asking the model to stay cheap is insufficient.
A support case example
A support assistant may spend up to four read calls and two drafting attempts on a routine order question. If it still cannot find the order, it should ask for an order ID or hand the case to a human, not search every customer record. For a complex shipping dispute, a larger approved budget may be justified. Show the agent remaining allowance through the runtime, and record the reason for any budget extension. Never let the model grant its own extension because it claims the next call will solve the task.
Stop without losing context
At the limit, return a concise status: what was verified, what remains uncertain, which actions were taken, and the next safe step. Save a checkpoint without unnecessary sensitive data so a human or a separately authorized run can continue. Do not silently mark a partly completed action as success. If a write operation is in an unknown state, reconcile it before stopping or restarting. Budget exhaustion should reduce additional work, not leave a duplicate-prone transaction half hidden from the user.
Evaluate the tradeoff
Run realistic held-out tasks at several budget levels. Plot successful resolutions, cost per resolution, latency, escalations, and unauthorized actions. Inspect whether a higher limit helps hard cases or simply allows repetitive calls. Use separate slices for language, task complexity, and missing-data cases. Monitor production distributions and revise limits when tool prices, models, or customer tasks change. The best threshold is the smallest one that meets the product's completion and safety target, with an explicit handoff for the rest. Budget limits are enforced in the code around the model, not in the prompt; see our AI agent development page for how we approach that surrounding system.
Technical references: OWASP agent security guidance, Anthropic agent evaluation guide. Related guide. Check the cited documentation against your own data, permissions and release version before applying this design.