# enforceable near-real-time spend limits — before the agent loop finishes
Monthly invoice alerts don't stop an agent looping right now. CloudCap puts enforceable spend limits at the proxy — trip in milliseconds when a limit spec is violated, not when the billing cycle closes.
A spend proxy counts operations in near-real time, estimates cost from a learned model, and stops or throttles traffic before the bill. The pattern generalizes beyond Cloudflare — AWS, GCP, Azure, and Kubernetes each have budgets and alerts, rarely enforceable trip-at-the-request limits.
Cloudflare billing is lagging and coarse — you discover cost after traffic ran. That was tolerable when humans clicked deploy occasionally. It is absurd now that agents can loop for hours: a runaway agent burns Workers invocations, D1 reads, and AI tokens while the dashboard still shows yesterday's number. There is no enforceable, near-real-time boundary between this request and this dollar.
Spend limits must be effects you can trip at the edge, not reports you read later. CloudCap's proxy/circuit-breaker counts operations per request, estimates cost from a learned model, and stops or throttles when a limit spec is violated — before the bill, before the loop. Models improve as trace aggregates meet invoice line items; limits stay enforceable regardless (conservative estimates trip early).
interactive specimen · prototype
Simulated agent loop — counters update per request; breaker trips when a limit spec is violated.
the urgency
Recursive tool calls, retry storms, cache-miss loops, just one more D1 query agents — dashboard billing is hours to days behind. Delegating compute to agents without a spend kill switch is ambient financial authority.
We enforce rate limits on APIs and auth on routes — but not on dollars spent. An agent can cost more in an afternoon than a human deploys in a month, with no circuit to trip.
enforcement
Limits evaluated at the spend proxy on every operation — milliseconds, not billing cycles. Hard trip → 429/503 immediately.
Monthly alerts and dashboard graphs are archaeology. Governance means the next request after the cap is rejected — with an audit entry naming which limit spec tripped.
spend proxy
Worker invocations, D1 reads/writes, KV ops, R2 egress, AI tokens, Queue publishes — per route, tenant, API key, agent session.
Updated on every operation through the proxy; cost estimate derived from model weights; breaker state visible on a live dashboard.
limit specs
Limits are data, not code — multiple specs stack.
Hard $ ceiling for account, worker, route, or agent identity — e.g. $5/day on this Worker.
Ops or $ per sliding window (minute, hour, day) — stops burst loops fast.
Cap only D1, only Workers AI, only egress — bind expensive bindings independently.
Per route, tenant, API key, agent session — isolate blast radius.
At current rate, monthly cap in 4h → trip on trajectory, not just totals.
Soft: throttle, degrade, sample. Hard: open circuit, reject with audit entry.
Monthly budget vs last-24h sliding window — both valid; spec declares which.
bill-to
Spend limits protect you. Bill-to lets you pass cost through — or hold tenants and agents to their own budgets — using the same proxy counters.
Every request already carries identity: API key, JWT claim, tenant slug, agent session ID, plan tier, route name, custom header, or dispatch-namespace tag. CloudCap extracts a bill-to dimension at the proxy and rolls op counts + estimated $ against that key — not just against the account.
Platforms meter per customer Worker (Workers for Platforms). API products charge per consumer key (AWS usage-plan-shaped, but with real-time $ caps). Internal teams get chargeback by service tag. Agents get per-session or per-user budgets so one runaway loop doesn't consume the org envelope.
Protect mode: hard cap on your Cloudflare/AWS/GCP account — trip before the invoice. Bill-to mode: accumulate usage per metadata key, enforce per-tenant limit specs, emit meter events for Stripe, Lago, Orb, or your ledger. A tenant over their prepaid balance trips the same way your account would.
Each counted operation emits: bill_to key, timestamp, SKU (worker req, D1 read, AI token), estimated cost, route, optional binding touches, trip status. Batching via Queues/SQS/Kafka for high volume; idempotent keys for reconciliation with provider invoices and external billing APIs.
Stack account-level caps with per-tenant absolute caps, per-api-key rate limits, per-agent-session burn-rate projections. Metadata-scoped specs use the same schema as dimension-scoped limits — the bill-to key is just the dimension value extracted from the request.
AWS API Gateway usage plans throttle by count, not dollars, and lag behind live spend. Cloudflare Workers for Platforms meters per tenant but expects you to wire billing yourself. CloudCap bill-to adds estimated $ per request, enforceable caps per metadata key, and export to whatever bills the customer — at the proxy, not in yesterday's dashboard.
attachment
Limit specs need a layer to land on. The convenient one is the deploy graph you already have.
Alchemy.run, SST, Pulumi, Terraform — anything that already declares Workers, routes, D1, KV, and bindings is a natural mount point: spend proxy wired in at deploy time, limit specs versioned next to the resources they protect, caps scoped to stack/stage/service the way tags already are.
Every Worker gets a front door by default; limit specs checked into the same PR as the handler; preview/staging/prod budgets as first-class config; agent-scoped dimensions derived from resource names and outputs — not guessed after the fact.
Alchemy and SST already sit close to the Cloudflare surface — good candidates for a CloudCap component or middleware export. Pulumi and Terraform can wrap modules: proxy Worker + counter store + breaker policy as reusable infra, limit spec schema as HCL/TS inputs.
Brownfield accounts, console-only deploys, or hand-maintained wrangler.toml still need limits — general introspection path: discover routes and bindings from the API, Tail Workers / Logpush / Analytics Engine for op histograms, manual or semi-automated proxy insertion. Slower to adopt, same enforcement semantics once the proxy is in path.
IaC is how you want to provision CloudCap; introspection is how you find what to cap when nobody left a graph. The spend proxy and limit spec schema are the same either way — only the wiring differs.
multi-cloud
CloudCap started on Cloudflare because the lab runs Workers — but agent runaway and billing lag are not Cloudflare-specific. Research sketch below; verify vendor APIs before production bets.
Every major cloud offers budgets, alerts, and cost reports — few offer enforceable near-real-time spend stops on the request path. Native tooling optimizes for finance visibility; CloudCap optimizes for trip-at-the-proxy enforcement plus learned op→$ models.
Native: AI Gateway spending limits (API-set caps). Edge: Workers proxy, Tail Workers, Logpush, Analytics Engine, Billing API — best fit for per-request counters and immediate 429/503. IaC hooks: Alchemy, SST, Terraform, Pulumi, wrangler. Leading adjacents: none purpose-built for edge spend breakers — DIY proxy is the pattern.
Native: Budgets API, Cost Anomaly Detection, Service Quotas (hard count limits, not $), SCPs (governance, coarse). Billing lag: CUR/budget data often hours–days behind. Kill-switch pattern: EventBridge/Lambda on budget threshold → stop instances, deny via SCP, or isolate account — DIY, not one toggle. IaC: Terraform, Pulumi, CDK, SST. Tools: Vantage, CloudHealth, CloudZero, Infracost (pre-deploy), Kubecost/OpenCost (EKS), ProsperOps (commitments).
Native: Billing Budget API + programmatic Pub/Sub notifications (~20min+ alert lag; not a hard stop). Documented killswitch: Cloud Function/Run on budget alert → detach project billing via Cloud Billing API. Usage metrics update faster than cost (~hourly). IaC: Terraform, Pulumi, Deployment Manager. Tools: Vantage, Infracost, Kubecost (GKE), Recommender (rightsizing, not enforcement).
Native: Cost Management budgets, action groups, email/webhook/Logic App triggers — alerts and automation hooks, no native request-level $ circuit. Billing lag similar to peers. Kill-switch pattern: Logic App/runbook on budget breach → deallocate resources or suspend subscription — DIY. IaC: Terraform, Pulumi, Bicep. Tools: Vantage, CloudHealth, Infracost, Kubecost (AKS).
Runtime attribution without provider-native $ caps at pod level. Kubecost / OpenCost map CPU/RAM/network to namespaces and labels — excellent visibility, weak enforcement (no cluster-wide spend breaker). CloudCap-shaped hook: admission webhook or service-mesh proxy with limit specs per namespace + learned $/CPU-hour from cloud billing reconcile.
Visibility & shift-left: Vantage (multi-cloud + SaaS billing APIs), Infracost (Terraform/Pulumi PR estimates — prevents deploy, doesn't stop runtime loops), CloudZero/CloudHealth (enterprise allocation + anomalies). None replace a spend proxy — they inform finance and PR gates; CloudCap trips traffic. Typical stack: Infracost at deploy, Kubecost in cluster, Vantage for exec view, CloudCap at the enforcement boundary.
Datadog (incl. Cloud Cost Management), New Relic, Grafana + OpenCost, Honeycomb, Sentry own the richest real-time metric layer of all — it is tempting to think they already do this. They don't: observability sits off the request path, on async ingestion plus lagging billing exports. It detects and alerts in seconds and can fire a webhook; it cannot deny the next request. The webhook's target is the thing that enforces — and that thing is CloudCap-shaped. Telling: the only spend caps these vendors hard-enforce are on their own bill (Sentry event quotas, Chronosphere telemetry volume) — single-SKU proof that enforceable caps are wanted, on the one data plane they happen to sit in-path for. Counting ops is table stakes; the in-path breaker, the learned op→$ model, and being the default front door are the moat.
Same primitives: op counter at the front door, declarative limit specs, learned model reconciled to invoice, circuit breaker. Attachment varies: API Gateway/Lambda authorizer (AWS), Cloud Run/Load Balancer middleware (GCP), App Gateway/Front Door (Azure), or mesh sidecar. IaC modules per provider; introspection where billing APIs and usage exports exist but deploy graph doesn't.
trace ingest
Tail Workers, Logpush, Workers Trace Events, Analytics Engine, OTel export — aggregate into operation histograms. The same OTel/APM pipeline (Datadog, Grafana, New Relic) is an input that sharpens the model, not a rival: ride the observability you already run, and add the in-path enforcement boundary it structurally can't be.
Refine model weights, catch proxy miscounts, reconcile predicted vs actual by SKU. Ingest improves estimates; enforcement stays at the proxy regardless.
cost model
Published Cloudflare list prices as starting weights; per-operation estimates with confidence bands.
Billing API / invoice CSV each cycle — adjust coefficients; drift alerts when D1 reads cost 2.3× what the model assumed.
When uncertain, trip on upper bound — false positives beat runaway agents.
mvp
Spend proxy Worker with near-real-time counters; absolute daily cap + per-minute rate limit; agent-scoped dimension; manual billing CSV reconcile; dashboard with live estimate, active limits, breaker state, last trip reason.
Agent runaway scenario: start loop, watch counters, trip before dashboard would know — measure estimated savings at breaker open.
artifacts
request metadata → op counts + estimated $ → per-tenant caps + external billing export
Alchemy, SST, Pulumi, Terraform — proxy + limit specs at deploy time
Cloudflare, AWS, GCP, Azure, K8s — native limits vs DIY kill-switch vs CloudCap hook points
near-real-time counters and trip logic — the interactive specimen on this page trips the dollar cap live
Workers, D1, KV, R2, AI, Queues — per-binding costs
Tail Workers, Logpush, Analytics Engine → model refinement
invoice CSV vs predicted spend
loop simulator with trip timing measurement — interactive on this page
edges
Agents delegated to Cloudflare Workers without a near-real-time spend kill switch — monthly dashboards don't stop a loop that's running now.