The $180 Meeting That Nobody Budgeted For
A developer kicks off a Cursor agent task at 4:00 PM and heads into a standup. The prompt is straightforward: refactor an authentication module and make sure the tests pass. The agent gets to work. It edits three files, runs the test suite, and hits a failing assertion. So it retries. It tweaks the logic, runs the tests again, gets a different error, and retries again. And again.
Forty API calls later, $180 in tokens have been burned. The code does not compile. The developer returns from the meeting to a terminal full of stack traces and an API bill that will take the finance team by surprise at the end of the month.
This is not hypothetical. It is happening daily at enterprises running AI coding tools without guardrails. And the problem is getting worse as agent mode becomes the default interface for tools like Cursor, Claude Code, Windsurf, and GitHub Copilot.
What a "Runaway" Agent Actually Looks Like
Agent mode in modern AI IDEs gives the model autonomy to make multi-step decisions: run shell commands, edit files across a repository, call APIs, execute tests, and iterate on the results. This is powerful when it works. When it does not, the failure mode is expensive.
Here is the typical pattern. The agent encounters a failing test or a linting error. It decides to fix the issue and retry. Each retry is a full API call that includes the entire accumulated context window — every previous attempt, every error message, every file it has read. The context grows with each iteration.
The Compound Cost Problem
A single retry loop can escalate rapidly:
- 10 retries × 100K tokens per call × $15 per million tokens = $15 per loop
- A developer running 3–4 agent sessions per day can generate $40–$60 in daily spend from retries alone
- Across a 50-person engineering team, that is $40,000–$60,000 per month in uncontrolled iteration costs
The context window grows linearly, but the cost grows super-linearly because each subsequent call includes all prior context. By retry number eight, the agent is sending 200K+ tokens per request — most of which are its own previous failed attempts.
Why Existing Controls Fail
Every major AI coding tool has some form of usage limit. None of them are sufficient for enterprise cost governance.
Cursor's max request limit is global. It caps the total number of requests a user can make per month, but it has no concept of cost-per-task. A developer can burn their entire monthly allocation on a single runaway session, leaving nothing for the rest of the month. There is no mechanism to say "stop if you have spent $X on this task."
Claude Code has token limits, but they operate at the session level without cost-aware enforcement. The tool does not know that 100K tokens of claude-opus-4 costs ten times more than 100K tokens of claude-haiku. A token limit treats all tokens as equal when they are definitively not.
No existing tool tracks cumulative spend across a multi-step agent session in real time. By the time a usage dashboard updates — typically hours or days later — the money is already gone. Dashboards tell you what happened yesterday. They do not prevent what is happening right now.
What Mid-Round Enforcement Means
Mid-round enforcement is the practice of evaluating and enforcing cost policies between individual API calls within a single agent session, not after the session ends, and not at the monthly billing cycle. It requires a proxy layer that sits between the IDE and the LLM provider, tracking cumulative token spend per session, per user, and per team in real time.
When a threshold is reached, the proxy can enforce one of three escalating responses:
- Soft limit — An alert fires to the developer and their team lead. The request is allowed through. This is useful for awareness without disruption during the first week of deployment.
- Hard limit — The request is blocked and a clear error message is returned to the IDE:
Session budget exceeded ($12.50 / $10.00 limit). Contact your admin or start a new session.The agent stops iterating immediately. - Session limit — The entire agent session is paused until a team lead or platform admin manually approves continuation. This is the nuclear option for high-cost models or production-critical environments.
The key insight is that enforcement happens between rounds, not after the fact. The proxy inspects every request, calculates the cumulative cost of the session, and makes a real-time decision before the next API call leaves the network.
Single-Request Quotas: The First Line of Defense
Before you address session-level runaway, you need to cap individual requests. A single-request quota sets a maximum token ceiling — or dollar ceiling — for any individual API call passing through the proxy.
This prevents a single, poorly-constructed prompt from consuming the entire budget. For example: no single request exceeds $2.00 worth of tokens. If a developer pastes an entire codebase into a prompt and asks for a full rewrite, the request is blocked before it reaches the provider.
Single-request quotas also catch a subtle failure mode: context window stuffing. When an agent retries repeatedly, the context window balloons. A single-request cap catches these inflated requests and forces the agent to start a fresh session with a clean context — which is often the correct engineering solution anyway.
Budgetary Quotas: Sustained Cost Control
Single-request and session-level limits handle acute cost spikes. Budgetary quotas handle sustained overspend. These are daily, weekly, or monthly caps applied per developer, per team, or per project.
With an on-premises proxy like Oolyx, budgetary quotas are automatically enforced at the network layer. No manual monitoring is required. No one needs to check a dashboard. The proxy tracks cumulative spend in real time and applies limits the moment they are reached.
This is particularly important for teams with variable workloads. A developer who consumes $200 in tokens on Monday — perhaps during a complex refactoring sprint — should not have unlimited access to the remaining $800 of the team's weekly budget. Budgetary quotas distribute spend across time and across people, preventing any single developer or session from monopolizing shared resources.
The Gauntlet: Test Before You Enforce
The biggest objection to enforcement is risk: "What if we block a request that a developer actually needed?" It is a valid concern. Aggressive limits can frustrate engineers and slow down legitimate work.
The solution is what we call the Gauntlet — a simulation mode that tests enforcement strategies against historical traffic data before deploying them in production. The Gauntlet replays your team's actual API traffic through a proposed policy configuration and reports exactly:
- How many requests would have been blocked
- How much money would have been saved
- Which developers and sessions would have been affected
- Whether output quality would have been degraded (by analyzing which blocked requests were retries vs. novel prompts)
This gives platform engineering teams the data they need to set limits confidently. Instead of guessing at thresholds, you calibrate them against real usage. You deploy enforcement knowing exactly what the impact will be.
Real Enforcement, Not Monitoring
There is a fundamental difference between a dashboard that shows you overspent yesterday and a proxy that prevents overspending today.
Monitoring tools are necessary but insufficient. They answer the question "how much did we spend?" They do not answer the question "how do we stop spending?" An observability dashboard that updates every six hours cannot prevent a runaway agent loop that burns $180 in twelve minutes.
Enforcement requires a proxy. It requires an inline system that evaluates every request in real time, calculates cost, compares it to policy, and makes a binary decision: allow or block. This is not something you bolt onto an existing monitoring stack. It is a fundamentally different architectural pattern — one that treats LLM API calls with the same governance rigor as database queries or network egress.
Oolyx is built for exactly this. It deploys on-premises as a reverse proxy, sits between your AI IDEs and LLM providers, and enforces cost policies in real time. No code changes. No agent modifications. No data leaves your network.
Deploy Cost Guardrails in a Day
If your engineering team is using Cursor, Claude Code, or any AI coding tool with agent mode, you are one bad retry loop away from a budget surprise. The fix is not to stop using agents — they are too productive when they work correctly. The fix is to deploy an enforcement layer that catches the failures before they become invoices.
Mid-round enforcement, single-request quotas, budgetary caps, and simulation testing are not theoretical features. They are available today, deployable on-premises, and configurable in hours, not weeks.