Per-request ceilings bound one call. They say nothing about ten thousand of them, which is how AI spend actually runs away.
A runaway agent loop obeying a $0.50 per-execution ceiling can spend $5,000 overnight, and every single execution is individually compliant. The ceiling was never wrong; it was answering a different question.
Summing spend and comparing loses under concurrency: two requests both read 95 of a 100 cap, both estimate 3, both pass, and the cap is breached with no bug in either. The check and the reservation share one transaction behind a lock on the budget scope, so the second request sees the first one's claim.
A reservation is priced at your max_tokens, not the expected output — an estimate is not a promise, and reserving the estimate lets any longer-than-predicted response breach the cap. Unused headroom returns the moment the true cost is known.
An endpoint with no price on file cannot be reserved against, so under a cap it is refused rather than treated as free. Cost estimation returns null, never zero, precisely so 'unknown' cannot masquerade as cheap.
A cap hit skips that candidate and walks on, so a cheaper model still gets its chance to fit in what is left. Only when nothing fits does the request fail.
Caps apply per organisation and per API key. Per-user and per-project caps require attributing an execution to a user or project, which is not recorded today. Rate limiting is separate and not built.