A Budget Alert Is Not a Limit: What Happens at Two in the Morning, and What Actually Stops It

Corrected on 2026-09-24. The first version said a budget alert and a budget action fire within minutes of the line being crossed. They do not: AWS updates a budget up to three times a day, hours apart. The film, this post and the fix below now say what AWS documents.

An agent’s role is a list of things it may do, and every one of them costs money. That makes the role a company card. Ask what the limit on the card is and the answer, on every cloud, is that there is not one: accounts have an invoice, not a ceiling. This post is the prose version of our ninety-second film on the subject, for readers who would rather scroll than watch.

The loop that works

A downstream service starts returning errors at 02:10. The agent does exactly what it was told: try again. Each try starts a model call, a function, a message on a queue, and each of those is billed. Nothing is broken. Every part is working as designed, and that is the problem. A loop that works is a loop that bills, and it will keep billing until something outside the loop stops it.

What the alert does

You set a budget, which is more than most accounts have. At 80% it sends an email. But the email cannot come before the budget knows, and AWS says when that is: “AWS Budgets information is updated up to three times a day. Updates typically occur 8–12 hours after the previous update” (AWS Cost Management). So the loop starts at 02:10, you wake at 07:12 to no email at all, and the budget catches up at 11:04. Nearly nine hours are billed before anyone is told. The other clouds say the plainer half of this once you go looking. Azure’s budget tutorial: “Resources aren’t affected, and your consumption isn’t stopped” (Microsoft Learn). Google’s: “Setting an alerts-only budget doesn’t automatically cap Google Cloud or Google Maps Platform usage or spending” (Google Cloud). A budget alert is a receipt, and it arrives hours late.

What the budget can do, and when

The same budget can be wired to act when the line is crossed. On AWS, a budget action can “run either automatically or after your manual approval”, and “your available actions include applying an IAM policy or a service control policy” (AWS Cost Management). Attach a deny policy to the agent’s role and the role stops. But the action runs when the budget sees the line crossed, which is the same update the email waits for. It stops a runaway week at the next update. It does not stop a night.

Google Cloud and Azure can be wired the same way, a budget publishing to Pub/Sub with a function that disables billing on the project (Google Cloud), or an action group running a runbook (Microsoft Learn), and each depends on when its budget is evaluated. All of them are off by default. Keep one: it is what bounds a month.

What stops a loop

A limit that stops a loop has to sit where the calls are made. The AWS SDKs already do this for calls to AWS: a maximum number of attempts, three by default, “exponential backoff with full jitter”, and a retry quota so that when failures persist “your application fails fast instead of waiting through retries that are unlikely to succeed” (AWS SDKs and Tools). The loop in the film is not an AWS call. It is the agent’s own instruction to try again, and no SDK default reaches it. Give it the same shape: a few retries, each waiting longer, then stop and page a person. The loop dies at 02:10 after three retries, and the bill is four calls. The budget is for the month; the retry limit is for the night.

What it does not cover

A retry limit catches a loop. It does not catch a leak: storage that grows a little every day never retries anything and never crosses a monthly line, it just moves the line a little each month. The retry limit stops the agent, not a person with the same keys, and the AWS budget action stops the role you name, not someone with a different one. On Google Cloud the form is blunter, disabling billing for the whole project, which stops everything in it including what you wanted kept. Name what a control does not cover, or what you have is a feature list.

Five minutes

Whether your AWS account has a budget at all, whether it acts or only emails, whether an agent’s role reaches further than it should, and whether you could prove afterwards what it did: one read-only Python file answers all four in about five minutes, and nothing leaves your machine. That is the Agent Readiness Check. The budget action above is one of the published templates beside its finding, with the cost, the reversal and its timing stated inside it. The retry limit is code, so it is part of the engagement rather than a template.