§1What happened
A software CEO was out to dinner when he found out an AI agent had spent a thousand dollars of tokens over the weekend, and the wallet had already paid the bill. Branden Jenkins, who runs the billing firm Maxio, had given one of his agents a token wallet and set it to refill itself: every time the balance hit zero, it charged his card another thousand dollars and the work went on. Over a quiet weekend the agent burned through one refill, then reached for the next. Nobody was watching, because nothing had been built to watch.
He is relaxed about it, and says so. The efficiency, in his telling, is worth the odd four-figure surprise, and the pressing problem at his company is not the spend but his staff feeling outpaced by the tool. Fair enough, and not our subject. We are reading the wallet, not the man. The wallet is the part that turns up in everyone else's stack next.
§2That was not a budget cap
Call the thing by what it did. A budget cap is a line the spend cannot cross: reach it and the work stops. What was wired up here is the opposite, a line the spend crosses on a loop, and each crossing quietly pulls another thousand out of the account and waves the agent through. That is not a ceiling. It is a fuel line set never to run dry.
The trap is that the two feel identical right up until the moment they do not. Both have a number in them, a thousand dollars, and both carry the comforting sense that somebody thought about cost. But one of them halts a runaway and the other one funds it. An auto-refill is close to the worst possible default for an unattended loop, because it removes the single signal, an empty wallet, that would otherwise have stopped the thing while everyone slept. You have taken the brake off and relabelled it a fuel gauge.
§3A ceiling only speaks after the money is gone
Now suppose it had been wired the other way: a hard ceiling, and at the ceiling the agent halts and asks. Much better. That is the difference between losing a thousand dollars and losing an unbounded number of them, which is the whole game on a bad weekend. But a ceiling still only speaks after the spend has happened. By the time it trips, a thrashing loop has already poured the entire allowance into nothing, and all the cap has done is decide how large the hole is allowed to get.
The spend is a symptom. The thing underneath it is a loop that is not converging, calling the model again and again without getting any closer to done, and a flat number cannot tell a thousand dollars of progress from a thousand dollars of going in circles. To catch that you have to watch the work, not the wallet. The wallet only tells you how the story ended.
§4The comfortable reframe
It is tempting, once the bill has landed, to step back and decide the interesting problem is a human one: who feels threatened by the tool, who adapts, who digs in. That conversation is real and worth having. It is also a very comfortable place to stand while the tap is still running. The money was not the point, goes the reframe, and so the mechanism that lost the money never gets a valve fitted, and the next quiet weekend costs exactly the same.
We would turn it around. The four-figure surprise is not a distraction from the real problem, it is the real problem announcing itself in the one language a finance team reads without translation. An agent that can spend money without a human in the loop needs a mechanism, not a philosophy. Build the mechanism first. Have the conversation about how everyone feels about AI once the spending has an off switch.
§5How we run it
So here is the boring version, the one with no surprise bill to write a think-piece about. Every job on our fleet carries a hard token budget that ends the run, it does not recharge a card. Hit the ceiling and the work stops and surfaces, full stop. There is no auto-refill anywhere in the stack, because "top up and carry on" is the one habit you never want a machine to have with your money and no one in the room.
Under the ceiling sits the part that catches the thrash before it ever reaches the ceiling. A panel of juror models samples a running job and asks the question a spend limit cannot: is this converging, or is it going round in circles. A loop that is burning tokens without getting closer to done is killed where it stands, not at the end of its allowance. And every job writes its cost into the audit log, so cost-per-task is a plain number we can read per agent and per run, which is how you notice a wallet quietly emptying before it empties a second time. None of it is clever. A cap that stops, a check that spots a loop going nowhere, and a log that makes the spend visible. The clever version is the one that refills itself while you are at dinner.