Ninety seconds, no audio

A budget alert is not a limit.

Your agent's role is a company card with no ceiling. What happens at two in the morning while nobody is watching, why the budget cannot stop it, and what can. The captions carry the narration; space plays and pauses, the arrow keys step a scene.

Also on YouTube, where you can share it or subscribe for the next one.

1 / 6 · The card
agent-runner, allowed
ec2:RunInstances
lambda:InvokeFunction
bedrock:InvokeModel
s3:PutObject
sqs:SendMessage
COMPANY CARD
•••• •••• •••• 4180
limit: none
Your agent has a role. A role is a list of things it may do.
Every one of them costs money. So the role is a company card.
What is the limit on the card?
There is not one. Cloud accounts do not have a ceiling. They have an invoice.
2 / 6 · The loop
agent.log · 02:10
02:10:04call payments-api → 503
02:10:05retry → 503
02:10:06retry → 503
02:10:07retry → 503
…×340 a minute, all night
spend since 02:10
$0and rising
A downstream service fails. The agent does what it was told: try again.
Each try starts a model call, a function, a queue message. Each one is billed.
Nothing is broken. Every part is working as designed.
Which is the problem: a loop that works is a loop that bills.
3 / 6 · The alert
02:10loop starts
07:12you wake: no email
11:04budget updates, email
11:04  budget: 728% of monthly
bill so far: $7,390
You did set a budget. Good. At 80% it sends an email.
But AWS updates a budget up to three times a day, hours apart.
At 07:12 you wake up. No email: the budget has not seen the loop yet.
It arrives at 11:04. Everything since 02:10 is billed.
A budget alert is not a limit. It is a receipt, and it arrives hours late.
4 / 6 · The limit
agent.log · with a retry limit
02:10:04call payments-api → 503
02:10:05retry 1 of 3, wait 1 s
02:10:07retry 2 of 3, wait 2 s
02:10:11retry 3 of 3 → 503
02:10:11stop. page a person.
LOOP STOPPED 02:10
The same budget can act, too: deny the agent's role when the line is crossed.
But it acts on the same update, at 11:04. That stops a runaway week, not a night.
A limit that stops a loop sits where the calls are made: a few retries, each waiting longer, then stop.
The loop dies at 02:10, after three retries. The bill is four calls, not $7,390.
The budget is for the month. The retry limit is for the night. You need both.
5 / 6 · What it does not do
A retry limit catches a loop. It does not catch a leak.
Storage that grows a little every day never retries anything and never crosses a monthly line. It just moves the line.
And a retry limit stops the agent, not a person with the same keys. Name what a control does not cover, or it is a feature list.
6 / 6 · Five minutes
agent_readiness_check.py · read-only
spend[critical] No AWS Budget exists
spend[high    ] Budgets alert but do not act
reach[critical] Roles with administrator power
proof[critical] No CloudTrail trail
 nothing above has left your machine
abacross.com/readiness
One Python file, twenty read-only calls, five minutes. The fixes are published beside the findings.
Does your account have a limit that acts? A role that reaches too far? A record you could prove?
One read-only file tells you, and nothing leaves your machine.
Free. Five minutes. Then you know.
0:00 / 0:00
The argument, in six lines

A loop that works is a loop that bills.

1

The card

A role is a list of things the agent may do, and every one of them costs money. Cloud accounts have no ceiling; they have an invoice.

2

The loop

A downstream service fails and the agent retries, as told. Each try starts a model call, a function, a message. Nothing is broken, and that is the problem.

3

The alert

At 80% the budget sends an email, but AWS updates a budget up to three times a day, hours apart. The loop starts at 02:10; the email comes at 11:04. Every minute between is billed. An alert is a receipt, and it arrives hours late.

4

The limit

The same budget can attach a deny policy to the agent's role, but only at that same update: it stops a runaway week, not a night. What stops a loop is a retry limit where the calls are made: a few retries, each waiting longer, then stop.

5

What it does not do

A retry limit catches a loop, not a leak: storage that grows a little every day never retries anything and never crosses a monthly line. And it stops the agent, not a person with the same keys.

6

Five minutes

One read-only file tells you whether your account has a limit that acts, a role that reaches too far, or a record you could prove. Nothing leaves your machine.

Run it: the free readiness check. The budget action, which bounds a month, is one CloudFormation template, published with its cost and reversal stated inside. Azure's cost budgets and Google Cloud's budget notifications have the same shape: an alert by default, and an action only if you wire one. The first film, who wrote the log?, is the other half of the story. Share this one: MP4, 1080p, 2.5 MB.

Next film

The permission that is not in the log.

A permission list for agent-runner: s3:GetObject, sqs:SendMessage, lambda:InvokeFunction, then lambda:CreateFunction and iam:PassRole highlighted, on Resource *3The permission that is not in the log.A role that is not an administrator becomes one with two ordinary calls, and the audit trail has no event for the moment it happened. Where the evidence is, and the two lines of policy that stop it.1:32

All films.