Agents Need Budgets, Not Just Goals

The demo agent loops until it succeeds. The production agent loops until it succeeds, or it hits a wall-clock limit, a token ceiling, a tool-call cap, or a confidence floor — whichever comes first. The difference between those two sentences is the difference between a prototype and a system you can put on payroll.

Failure modes are the spec

When we design an agentic workflow, the first document isn’t the happy path. It’s the failure table: every way the agent can be wrong, what that costs, and who finds out. An invoice agent that mis-posts a ledger entry has a very different failure cost than a research agent that cites a weak source. The architecture follows from that table, not from the model choice.

The table forces three design decisions:

1. What the agent may do alone — actions where a wrong answer is cheap and reversible.
2. What it must queue for review — actions where a wrong answer is expensive but the agent’s draft still saves time.
3. What it must never do — actions that stay human, full stop.

Budgets are architecture, not configuration

Every agent we ship runs inside an envelope:

envelope = Envelope(
    max_tokens=150_000,
    max_tool_calls=25,
    max_wall_seconds=300,
    min_confidence_to_act=0.85,
)

When any limit trips, the agent doesn’t retry harder — it stops, summarizes what it knows and where it got stuck, and escalates with its working attached. A stuck agent that hands a human a half-finished trail is useful. A stuck agent that burns tokens in a retry loop is a cloud bill.

Verification is a separate job

Agents grade their own homework badly. Our pipelines separate the doer from the checker: the worker agent produces, a verifier — different prompt, often a different model — checks the output against the source material and the task contract. On the invoice system, the verifier catches roughly one in twelve extractions before they reach the ledger. That number is why the client trusts the other eleven.

Boring is the feature

None of this is glamorous. Budgets, review queues, audit logs, escalation paths — it’s the plumbing that makes autonomy safe enough to actually use. But that’s the job. Anyone can make a model act. The engineering is in making it stop.