In February 2026, ZeroClaw opened RFI #2269: "Token consumption and cost management for productized agent workloads." The problem was clear — running real agent workloads through a single high-end model cost $5/hour per user. Existing mitigations (history compaction, model routing, daily budget alerts) were insufficient.
The RFI identified a structural gap that every agent framework hits:
"Post-spend-only enforcement allows avoidable cost overruns in productized workloads and weakens operator budget controls."
— ZeroClaw PR #2333 description
This is the fundamental distinction:
Observability tools are diagnostic. Enforcement tools are preventive. ZeroClaw needed both, but the enforcement layer did not exist in their runtime.
ZeroClaw's solution, shipped in PR #2333, added preflight budget checks in the agent loop execution — before model dispatch. The architectural pattern:
The critical design decision: the check happens before the API call. Not during. Not after. The model provider never sees the request if the budget check fails. This means:
The PR added [cost.enforcement] as a first-class configuration section. The enforcement logic runs as an interceptor in the agent loop — conceptually:
# Pseudocode: pre-flight enforcement pattern
def agent_loop_step(agent, task):
# Prepare the API call
estimated_cost = estimate_cost(task.prompt, task.model)
# Pre-flight budget check
session_total = get_session_spend(agent.session_id)
if session_total + estimated_cost > agent.budget_limit:
return BudgetExceededError(
rule="session_budget",
spent=session_total,
limit=agent.budget_limit,
attempted_cost=estimated_cost
)
# Execute the call (only if budget allows)
response = model_api.call(task)
record_spend(agent.session_id, estimated_cost)
return responseThe structured error return is important. The agent does not crash — it receives a typed error it can act on:
{
"decision": "BLOCKED",
"rule": "session_budget",
"reason": "Session spend $45.00 + estimated call $8.00 exceeds session budget of $50.00",
"severity": "high"
}Building pre-flight enforcement sounds simple until you hit the boundary cases. These are the ones that catch teams off-guard:
A single API call looks cheap ($0.50). But it has a 30% failure probability, and each failure triggers a retry that costs $5. The expected cost of the call is not $0.50 — it's $0.50 + (0.3 × $5) = $2.00. A naive per-call budget check approves the $0.50 call. A cascade-aware check blocks it.
This is what cascade_cost rule type solves: expected_cost = call_cost + (fail_probability × reversal_cost).
A daily budget of $500 seems generous. But a cron-triggered agent at 2 AM makes 200 calls in one session, each costing $2.50. By 2:03 AM, the daily budget is gone. The remaining 21 hours of the day have zero budget.
Session-scoped budgets fix this. Set max_session: $50 and the agent can spend at most $50 per session, regardless of how many sessions run in a day.
An agent configured to use claude-haiku silently resolves to claude-opus because the haiku model ID is invalid. Each call costs 50x more than expected. Cost dashboards show $0 because the cost tracking field is broken. The agent has no awareness it is spending $133/call instead of $2.50/call.
Pre-flight enforcement catches this: the estimated cost from the prompt length × opus rate exceeds the transaction limit. The call is blocked before it executes.
ZeroClaw's PR added the enforcement layer at the runtime level — integrated into their agent loop. This is the right architecture for a framework that controls its own execution model.
For teams who want a standalone, framework-agnostic enforcement engine, we built AgentShield — a pure Python 3.11 stdlib spend-control firewall with 9 composable rule types and 56 labeled test scenarios.
The 56-scenario eval gym is independently useful as a test suite for any spend-control implementation — including yours. If you're building enforcement logic, run it against these scenarios. They're MIT licensed. View the spec →
ZeroClaw's implementation validates a shift happening across the AI agent ecosystem: spend control is moving from observability to enforcement.
The teams running production agents — ZeroClaw, OpenClaw (see issue #42475), and others — are all converging on the same architecture: pre-dispatch cost evaluation, structured block decisions, and session-scoped budgets with decay.
If you're building an agent framework, the question is not whether to add enforcement — it's which edge cases you handle. The 56-scenario benchmark is our answer to that question.
This case study is based on publicly available GitHub issues and PRs. ZeroClaw is an open-source project. AgentShield is MIT licensed and independent. We wrote this because the architectural pattern is important and deserves clear documentation.