In February 2026, ZeroClaw opened RFI #2269: "Token consumption and cost management for productized agent workloads." The problem was clear, running real agent workloads through a single high-end model cost $5/hour per user. Existing mitigations (history compaction, model routing, daily budget alerts) were insufficient.
The RFI identified a structural gap that every agent framework hits:
"Post-spend-only enforcement allows avoidable cost overruns in productized workloads and weakens operator budget controls."
, ZeroClaw PR #2333 description
This is the fundamental distinction:
Observability tools are diagnostic. Enforcement tools are preventive. ZeroClaw needed both, but the enforcement layer did not exist in their runtime.
ZeroClaw's solution, shipped in PR #2333, added preflight budget checks in the agent loop execution, before model dispatch. The architectural pattern:
The critical design decision: the check happens before the API call. Not during. Not after. The model provider never sees the request if the budget check fails. This means:
The PR added [cost.enforcement] as a first-class configuration section. The enforcement logic runs as an interceptor in the agent loop, conceptually:
# Pseudocode: pre-flight enforcement pattern
def agent_loop_step(agent, task):
# Prepare the API call
estimated_cost = estimate_cost(task.prompt, task.model)
# Pre-flight budget check
session_total = get_session_spend(agent.session_id)
if session_total + estimated_cost > agent.budget_limit:
return BudgetExceededError(
rule="session_budget",
spent=session_total,
limit=agent.budget_limit,
attempted_cost=estimated_cost
)
# Execute the call (only if budget allows)
response = model_api.call(task)
record_spend(agent.session_id, estimated_cost)
return responseThe structured error return is important. The agent does not crash, it receives a typed error it can act on:
{
"decision": "BLOCKED",
"rule": "session_budget",
"reason": "Session spend $45.00 + estimated call $8.00 exceeds session budget of $50.00",
"severity": "high"
}Building pre-flight enforcement sounds simple until you hit the boundary cases. These are the ones that catch teams off-guard:
A single API call looks cheap ($0.50). But it has a 30% failure probability, and each failure triggers a retry that costs $5. The expected cost of the call is not $0.50, it's $0.50 + (0.3 × $5) = $2.00. A naive per-call budget check approves the $0.50 call. A cascade-aware check blocks it.
This is what cascade_cost rule type solves: expected_cost = call_cost + (fail_probability × reversal_cost).
A daily budget of $500 seems generous. But a cron-triggered agent at 2 AM makes 200 calls in one session, each costing $2.50. By 2:03 AM, the daily budget is gone. The remaining 21 hours of the day have zero budget.
Session-scoped budgets fix this. Set max_session: $50 and the agent can spend at most $50 per session, regardless of how many sessions run in a day.
An agent configured to use claude-haiku silently resolves to claude-opus because the haiku model ID is invalid. Each call costs 50x more than expected. Cost dashboards show $0 because the cost tracking field is broken. The agent has no awareness it is spending $133/call instead of $2.50/call.
Pre-flight enforcement catches this: the estimated cost from the prompt length × opus rate exceeds the transaction limit. The call is blocked before it executes.
ZeroClaw's PR added the enforcement layer at the runtime level, integrated into their agent loop. This is the right architecture for a framework that controls its own execution model.
For teams who want a standalone, framework-agnostic enforcement engine, we built AgentShield, a pure Python 3.11 stdlib spend-control firewall with 7 composable rule types and 56 labeled test scenarios across 9 eval categories.
The 56-scenario eval gym is independently useful as a test suite for any spend-control implementation, including yours. If you're building enforcement logic, run it against these scenarios. They're MIT licensed. View the spec →
ZeroClaw's implementation validates a shift happening across the AI agent ecosystem: spend control is moving from observability to enforcement.
The teams running production agents, ZeroClaw, OpenClaw (see issue #42475), and others, are all converging on the same architecture: pre-dispatch cost evaluation, structured block decisions, and session-scoped budgets with decay.
If you're building an agent framework, the question is not whether to add enforcement, it's which edge cases you handle. The 56-scenario benchmark is our answer to that question.
This case study is based on publicly available GitHub issues and PRs. ZeroClaw is an open-source project. AgentShield is MIT licensed and independent. We wrote this because the architectural pattern is important and deserves clear documentation.