{"slug": "ai-agent-budgeting-why-i-built-a-circuit-breaker", "title": "AI Agent Budgeting: Why I Built a Circuit Breaker", "summary": "A developer built a local proxy in Rust that acts as a circuit breaker for AI coding agents, intercepting every LLM request and tool payload to enforce budget and security rules in real time. The proxy compiles markdown-based Standard Operating Procedures into WebAssembly rules and can allow, inject, substitute, or kill execution within 5ms. The tool is designed to prevent runaway loops and data leaks that observability tools only detect after damage is done.", "body_md": "# AI Agent Budgeting: Why I Built a Circuit Breaker\n\nShortly after that, I caught another agent attempting to `curl -d @.env`\n\nto an external endpoint. It wasn't a security breach from the outside, but the agent decided a debug payload would be helpful and targeted the most information-dense file in the directory. Relying on \"I happened to be looking\" is not a viable security model for a professional AI workflow.\n\n## The Observability Gap: Cameras vs. Breakers\n\nMost current LLM observability tools act like security cameras. They provide incredible traces, spans, and cost dashboards, but they sit *beside* the execution path, not *in* it. They are designed for post-mortems, not prevention. If an agent starts burning through your budget or leaking environment variables, these tools tell you exactly how it happened after the damage is done.\n\nIn electrical engineering, you don't protect a house by logging current spikes; you install a circuit breaker. When the current exceeds a threshold, the circuit opens and stops the flow before the house catches fire. Coding agents—whether you use [Claude](/en/tags/claude/) Code, Cursor, or Aider—run raw shell commands and modify filesystems in unsupervised loops. We need a technical intervention layer that can kill a process in real-time.\n\n## Implementing a Local Proxy for Agent Control\n\nTo solve this, my team and I developed a local proxy written in Rust. The goal was to create a \"breaker\" that sits between the agent harness and the system. Every LLM request and tool payload must pass through this proxy before execution.\n\nInstead of complex JSON configurations, we use markdown-based Standard Operating Procedures (SOPs) that live directly in the git repository. The proxy compiles these SOPs into WebAssembly (Wasm) rules and evaluates every intercepted call in-memory.\n\n**The logic flow works as follows:**\n\n1. **Interception:** The proxy catches the tool call (e.g., a shell command or API request).\n\n2. **Evaluation:** The Wasm rule engine checks the call against the SOP.\n\n3. **Action:** The proxy chooses one of four paths:\n\n- **Allow:** The command proceeds normally.\n\n- **Inject:** Guardrail context is added to the prompt to steer the agent.\n\n- **Substitute:** Parameters are modified on the fly.\n\n- **Kill:** The execution thread is terminated immediately.\n\nTo ensure this didn't disrupt the developer experience, we optimized the evaluation to happen in under 5ms. If a safety tool adds noticeable latency, developers will simply disable it.\n\n## Real-World Application and Deployment\n\nBy implementing this as a deployment layer, we've effectively neutralized the \"runaway loop\" problem. A budget-specific SOP now kills the loop the moment a spend threshold is hit, rather than waiting for the monthly invoice to arrive.\n\nFor those looking to implement a similar guardrail or try the tool, the setup is designed to be beginner-friendly. Here is the basic deployment command to get the proxy running locally:\n\n```\nnpm install -g @intutic/cli @intutic/proxy\nintutic connect\n```\n\nFor a more advanced configuration, you can define a budget rule in your SOP markdown file like this:\n\n```\n## Budget Guardrail\n- **Threshold:** $10.00 per session\n- **Action:** Kill execution and notify user\n- **Scope:** All API calls to anthropic.com/v1\n```\n\nMoving from \"observing\" AI to \"controlling\" AI is the only way to scale these agents across a professional engineering team without risking a massive surprise bill or a data leak.\n\n[Next Multi-Agent Debugging: Why Handoffs Are Your Biggest Blind Spot →](/en/threads/2861/)", "url": "https://wpnews.pro/news/ai-agent-budgeting-why-i-built-a-circuit-breaker", "canonical_source": "https://promptcube3.com/en/threads/2909/", "published_at": "2026-07-24 21:03:52+00:00", "updated_at": "2026-07-24 21:36:37.255073+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-infrastructure"], "entities": ["Claude", "Cursor", "Aider", "anthropic.com", "Rust", "WebAssembly", "Intutic"], "alternates": {"html": "https://wpnews.pro/news/ai-agent-budgeting-why-i-built-a-circuit-breaker", "markdown": "https://wpnews.pro/news/ai-agent-budgeting-why-i-built-a-circuit-breaker.md", "text": "https://wpnews.pro/news/ai-agent-budgeting-why-i-built-a-circuit-breaker.txt", "jsonld": "https://wpnews.pro/news/ai-agent-budgeting-why-i-built-a-circuit-breaker.jsonld"}}