An alert is not a control.
August 16, 2026
Most AI budget governance is a threshold and an email. That works for infrastructure whose cost accrues on a human timescale. It does not work for agents, which can consume a month's allowance in an afternoon by looping on a task that will never converge. The control has to sit where the next model call is decided. DeepSeek's open-source harness makes that point unusually visible, because it names the places.
The two decision points
Inside deepseek-harness, work is organised into turns and steps. A step is one model request plus the tool calls it produces; a turn contains zero or more steps. Two checkpoints bracket the expensive parts:
| Checkpoint | Runs | Governs |
|---|---|---|
| Pre-step | Before the model request goes out | Whether to spend on another model call |
| Pre-execute | Before any tool body runs | Whether an action is permitted at all |
Both are ordered chains where each participant can inspect, modify, or refuse. The pre-step decision is documented as authoritative: what the chain returns is what happens. That is the difference between an observability hook and a control.
Controls that belong at pre-step
- A hard step ceiling per turn. The single highest-value control. It converts an unbounded failure mode into a bounded one.
- A cumulative token budget. Sum what the session has spent so far; refuse the next step past the limit.
- Model downshifting. Past a soft threshold, rewrite the request to a cheaper route rather than refusing. Degraded service beats no service and beats an open tab.
- Context-size limits. The prompt is already assembled at this point, so its size is measurable before you pay for it.
Controls that belong at pre-execute
Tool execution runs a three-phase pipeline: a pre-execute chain, then permission guards, then the tool body itself under sandbox and filesystem gatekeeping. A post-execute chain can accept, block, replace, or add context to the result.
Two design choices here are worth copying regardless of what harness you run. First, the permission guards are deliberately one-directional: they can deny or abstain, never grant. Second, if the approval prompt is absent or cannot be answered, the result is denial. Both mean the system fails closed. Most homegrown agent policy layers fail open when the approval channel is missing, which is precisely the moment the control was needed.
Filesystem writes are separately gated as explicit write or edit intents, so mutation is never an incidental side effect of a tool running.
Every decision is recorded
The pipeline writes three events into the session log: the tool call before execution, a dispatch record for internal sub-calls, and the final authoritative result. Sub-calls being logged separately matters for audit — a single model-visible tool call that fans out internally cannot hide the fan-out. Denials are part of the record too, which turns policy from something you assert into something you can evidence.
A practical control set
- Step ceiling per turn, tuned from observed distributions rather than guessed.
- Cumulative token budget per session, with a soft threshold that downshifts and a hard one that stops.
- Tool allow-lists by cost class, so expensive tools are unavailable in cheap contexts.
- Sandbox policy on subprocess and network access, so egress is metered.
- Explicit write gating, so unreviewed mutations require an intent.
The caveat
DeepSeek Harness is a developer preview whose documentation warns of compatibility-breaking changes. Treat the specific names as illustrative and the structure as the requirement: your agents should have an enforcement point before the model call and another before the tool runs, and both should fail closed.
Related
- An agent audit trail finance can actually read
- Your agent harness decides how much lock-in you buy
- What is AI governance
- Model routing as a cost lever
FAQ
Why are monthly AI budget alerts insufficient for agents?
Because an agent can spend a month's allowance in an afternoon. A non-converging loop issues model calls continuously, so a control that reports after the fact reports a loss rather than preventing one. Enforcement has to sit at the point where the next model call is decided.
Where can spend limits be enforced in an agent harness?
At two points. Before a model request is issued, where step caps, token ceilings, and model downshifting apply. And before a tool executes, where permission guards and execution policy apply.
What does fail-closed mean for agent permissions?
It means that if the approval channel is missing or cannot answer, the answer is denial rather than permission. DeepSeek's harness works this way: guards can deny or abstain but never grant, and an unanswerable approval prompt denies.
What controls actually reduce runaway agent spend?
A hard step ceiling per turn, a cumulative token budget checked before each step, model downshifting past a soft threshold, tool allow-lists by cost class, and sandbox policy on subprocess and network access.