Give one agent a ceiling and try to break it.
Test mode is the whole engine, with no card. Fan out sub-agents against a shared budget and watch the envelope hold.
Use case ยท Agent spending limits
{
"action_type": "tool.invoke",
"resource": "api.openai.com",
"cost_cents": 900,
"currency": "USD"
}{
"decision": {
"outcome": "denied",
"rule": "run_budget_exhausted",
"headroom": { "budget_remaining_cents": 0 }
}
}The eleventh sub-agent gets the same answer as the first one would have, because they share the envelope.
Why the usual answers stop short
The longer versions: versus an if statement in your orchestrator and versus card limits.
The envelope
{
"mode": "allowlist",
"rules": [
{ "kind": "spend_window", "max_cents": 25000,
"window_seconds": 86400 },
{ "kind": "rate_limit", "max_actions": 200,
"window_seconds": 60, "action_types": ["tool.invoke"] },
{ "kind": "cost_cap", "max_cents": 5000,
"action_types": ["payment.create"] },
{ "kind": "condition", "effect": "require_approval",
"rule_name": "unknown_vendor",
"when": { "not": { "field": "resource", "operator": "in",
"value": ["api.openai.com", "api.anthropic.com"] } } }
]
}The daily window covers every action type at once, so a runaway loop on tools eats the headroom the payment would have needed.
The part that is not a config flag
Honest limit, stated plainly: a control layer only binds the paths you route through it. More on what that means in what an agent control layer is.
Questions
No, and keep them. They catch things Kordio never sees, like what the model is about to say. The difference is that a framework hook holds no budget across runs and cannot produce evidence that anything was authorized.
One call before the action. Use simulate for a dry decision when you want to check without reserving anything. The ledger projection is deliberately outside the decision path, so books can never slow a decision down.
You decide the failure mode: fail closed and the agent stops, or fail open and you accept the exposure for that window. We would rather you make that choice explicitly than discover it during an incident.
That is the point. Action types are dotted strings, so tool.invoke and payment.create draw down the same envelope. Spend on one consumes headroom for the other.
No. Kordio holds no funds and issues nothing. It decides and it signs. Whatever executes the action still executes it.