Ninety seconds, no audio

A budget alert is not a limit.

Your agent's role is a company card with no ceiling. What happens at 02:14, and what the budget could have done instead. The captions carry the narration; space plays and pauses, the arrow keys step a scene.

1 / 6 · The card
agent-runner, allowed
ec2:RunInstances
lambda:InvokeFunction
bedrock:InvokeModel
s3:PutObject
sqs:SendMessage
COMPANY CARD
•••• •••• •••• 4180
limit: none
Your agent has a role. A role is a list of things it may do.
Every one of them costs money. So the role is a company card.
What is the limit on the card?
There is not one. Cloud accounts do not have a ceiling. They have an invoice.
2 / 6 · The loop
agent.log · 02:10
02:10:04call payments-api → 503
02:10:05retry → 503
02:10:06retry → 503
02:10:07retry → 503
…×340 a minute, all night
spend since 02:10
$0and rising
A downstream service fails. The agent does what it was told: try again.
Each try starts a model call, a function, a queue message. Each one is billed.
Nothing is broken. Every part is working as designed.
Which is the problem: a loop that works is a loop that bills.
3 / 6 · The alert
02:10loop starts
02:14budget crosses 80%
02:14email sent
07:12email read
07:12  budget: 412% of monthly
bill so far: $4,180
You did set a budget. Good.
At 80% it sends an email. At 02:14.
The email is read at 07:12. Everything between is billed.
A budget alert is not a limit. It is a receipt that arrives early.
4 / 6 · The action
agent-runner
ec2:RunInstances
lambda:InvokeFunction
bedrock:InvokeModel
s3:PutObject
Deny *  ← attached by the budget at 02:14
spendlimit $200
$0and rising
LOOP STOPPED 02:14
The same budget can do something else when the line is crossed.
It can attach a policy to the agent's role that denies everything.
The loop dies at the limit, at 02:14, while you sleep. The bill is $200, not $4,180.
This has existed for years. It is off by default, and a budget without it is an email.
5 / 6 · What it does not do
A stop at the line catches a loop. It does not catch a leak.
Storage that grows a little every day never crosses a monthly line. It just moves the line.
And it stops the role, not a person. Name what a control does not cover, or it is a feature list.
6 / 6 · Five minutes
agent_readiness_check.py · read-only
spend[critical] No AWS Budget exists
spend[high    ] Budgets alert but do not act
reach[critical] Roles with administrator power
proof[critical] No CloudTrail trail
 nothing above has left your machine
abacross.com/readiness
One Python file, twenty read-only calls, five minutes. The fixes are published beside the findings.
Does your account have a limit that acts? A role that reaches too far? A record you could prove?
One read-only file tells you, and nothing leaves your machine.
Free. Five minutes. Then you know.
0:00 / 0:00
The argument, in six lines

A loop that works is a loop that bills.

1

The card

A role is a list of things the agent may do, and every one of them costs money. Cloud accounts have no ceiling; they have an invoice.

2

The loop

A downstream service fails and the agent retries, as told. Each try starts a model call, a function, a message. Nothing is broken, and that is the problem.

3

The alert

The budget crosses 80% at 02:14 and sends an email. The email is read at 07:12. Every minute between is billed. An alert is a receipt that arrives early.

4

The action

The same budget can attach a deny policy to the agent's role the moment the line is crossed. The loop dies at the limit while you sleep. It is off by default.

5

What it does not do

A stop at the line catches a loop, not a leak: storage that grows a little every day never crosses a monthly line. And it stops the role, not a person.

6

Five minutes

One read-only file tells you whether your account has a limit that acts, a role that reaches too far, or a record you could prove. Nothing leaves your machine.

Run it: the free readiness check. The budget action is one CloudFormation template, published with its cost and reversal stated inside. Azure's cost budgets and Google Cloud's budget notifications have the same shape: an alert by default, and an action only if you wire one. The first film, who wrote the log?, is the other half of the story. Share this one: MP4, 1080p, 2.3 MB.