A per-run spend ceiling stops one expensive run. It does nothing about a malformed upstream payload that triggers four hundred cheap runs in ninety minutes.
What does a two-axis cap look like?
Steps, spend, and wall-clock hard-capped per run — and a second ceiling on aggregate spend per hour per agent, which trips a circuit breaker rather than failing individual runs.
What should happen when the hourly cap trips?
Fail closed and page a human. The agent stops acting, the queue backs up visibly, and someone looks at the upstream feed. A backed-up queue is a much cheaper failure than a quiet one.