AI Agent Cost Control: 2026's Shift to Session Caps

AI agent cost control moved down a level in August 2026. On August 6, AWS shipped spend and behavior ceilings on the Amazon Bedrock AgentCore gateway; on August 7, Anthropic shipped a hard dollar cap on a single Claude Managed Agents session. First-party spend limits at the big providers have been monthly and account-scoped. Now they can bound one run.

TL;DR: Anthropic's session budgets let you set a hard ceiling — written in whole US cents — when you create a Managed Agents session. The platform prices everything the session consumes at public list rates and stops issuing new model requests once that total reaches the cap.¹ AWS landed a day earlier with temporal policies and gateway rate limiting that bound consumption regardless of how the agent behaves.²

The two announcements answer the same complaint. A monthly org-level cap tells you your company will not spend more than $50,000 in August. It tells you nothing about whether one stuck agent will spend $6,000 tonight.

What You'll Learn

• What Anthropic's session budgets actually enforce, and where the cap is checked
• What AWS shipped on AgentCore a day earlier, and why it sits at the gateway
• Where OpenAI and Google enforce spend today, and at what granularity
• Why a "hard cap" still overshoots, and by how much
• What none of these controls fix

Why Agent Spend Became a Board Problem

The demand for this is measurable. KPMG's Global AI Pulse for Q2 2026 asked 2,145 senior leaders across 20 countries, territories and jurisdictions whether their organization had "questioned, delayed, or scaled back the deployment of AI agents because the expected costs began to outweigh the value generated."³

Forty-nine percent had. KPMG calls this rephasing, and the split matters: 24% scaled back or narrowed a deployment, while 22% delayed or paused a rollout.³

The controls were thinner than the concern. Only 40% of those organizations had usage or token budgets in place at all, and only around a third reported full visibility into their AI operating costs.³

In KPMG's US tracking sample — 204 US-based leaders at organizations with $1 billion or more in revenue — just 26% said the operating costs of their AI systems were fully visible today.⁴

AWS framed the mechanism plainly in its announcement: "An agent hits a failing tool and retries through the night, running through the token budget, because nothing capped how much it could consume."²

That is the structural problem. An agent decides its own number of steps, so a task's cost depends on how the model chooses to work — not on a rate you set in advance. We covered the token side of this in AI agent token costs; this is the enforcement side.

What Anthropic Shipped on August 7

A session budget is an optional hard spend ceiling attached when you create a Claude Managed Agents session.¹ It cannot be added later — attaching a budget to a session created without one returns a 400 error.

The cap is written as a whole number of US cents, as a string: "2500" is $25.00, "50" is 50 cents. Decimal forms like "25.00" are rejected, and USD is the only supported currency.¹

{
  "budget": {
    "type": "limit",
    "max_list_cost": { "amount": "2500", "currency": "USD" }
  }
}

What counts toward the total is defined precisely: model tokens at each served model's list price, web searches at $10 per 1,000 searches, and session running time at $0.08 per hour.¹

One detail deserves attention from anyone with an enterprise contract. The budget is measured against public list rates, not your negotiated price. If your organization has discounts, the session pauses when the list-price total hits the cap — so your actual billed spend may land below it.¹

When the ceiling is reached, the session does not die. It goes idle with a stop_reason of budget_reached, and its history and sandbox are preserved.¹

Changing the cap to any value strictly above what the session has already consumed — or setting budget to null — resumes the paused work automatically. Removal is one-way, though: a session whose budget has been removed cannot be given a new one.¹

While a session sits at its cap, it accepts only events that settle work already in progress — tool confirmations, tool results, and interrupts. Anything that would start new work, such as user.message, is rejected with a 400.¹

Deployments take the same budget object, with an important caveat: the cap is copied onto each session the deployment starts, so it bounds each run separately rather than the deployment's cumulative spend.¹

The Ceiling Is Not Exact — and Anthropic Says So

The cap is enforced between model requests, not mid-request. The request already in flight when the total crosses the cap runs to completion.¹

Anthropic's own documentation gives the example: a session capped at "50" — 50 cents — can pause with a recorded list_cost of "53". That is a 6% overshoot on a small cap, and the docs call it "expected, not a billing error."¹

The overshoot is bounded by one model request per thread. That is a meaningful guarantee, but it scales with how expensive a single request is, which is why the docs advise sizing the cap "with that one-request margin in mind."¹

There is a second edge. If a budgeted session's usage comes to include a model with no public list price, the budget can no longer measure spend — and changing the budget is rejected. The only way out is to remove it.¹

What AWS Shipped a Day Earlier

AWS approached the same problem at the gateway rather than in the session object. Its August 6 release added two things to Amazon Bedrock AgentCore.²

Temporal policies extend AgentCore's existing stateless authorization checks with session history. Rather than judging each request alone, the policy engine looks at what the agent has already done in that session.

AWS's example is a budget one: a policy "can tally what an agent has spent in a session and block the next purchase once the budget is reached, even if that purchase is under the individual limit."²

These policies are written in Dogwood, a new policy language purpose-built for AI agents. Dogwood is built on the foundation of Cedar and adds temporal constructs — rate limits, time windows, prerequisite steps, escalation triggers — available as an open source specification and reference implementation under Apache 2.0.²

Enforcement itself lives in AgentCore Policy, the layer that decides on every tool call whether an agent's action is allowed; AWS launched Dogwood support inside it, and because any valid Cedar policy is also a valid Dogwood policy, existing policy sets carry over without a rewrite.⁵

The spend example is concrete in the language. A sum_within policy can forbid a transfer "once more than $5,000 has been transferred in the last hour, across any number of transfers."⁵

Gateway rate limiting is the blunter instrument. It caps consumption per user across every tool, model, and agent behind the gateway, using OAuth or IAM identities teams already manage.²

Limits cover three axes, and AWS explains why all three are needed: "A retry loop shows up as request volume, a reasoning-heavy task shows up as tokens, and a long research session shows up as a connection held open while very little traffic moves."²

The critical property is placement. Both controls sit at the gateway rather than in the agent — AWS notes that rate limits "take effect once they are configured, with no changes to agent code."²

For temporal policies, AWS goes further: the agent "does not see the policy logic and cannot reason around it, regardless of how it is prompted."² That is the same argument we saw in agent reliability work: structure beats instructions.

Where Each Platform Enforces Agent Spend Today

The four major platforms now enforce at visibly different granularities. This is the comparison that matters when you are choosing where to run an agent fleet.

Read the "Scope" column and the pattern is the whole story. Anthropic and AWS bound a run. Google and OpenAI bound a billing period.

That distinction is not academic. A monthly cap set at a level your business can absorb is, by construction, large enough for a single runaway session to hide inside it.

Google's Spend Caps do move faster than traditional billing: Google says caps for AI services trigger within minutes of hitting the threshold, rather than waiting for billing data to reconcile.⁷ But the feature is Pre-GA, and a cap can only be scoped to a single project and a single eligible service, on a monthly period starting the first of each month.⁶

OpenAI's own documentation is candid about the same softness Anthropic acknowledges: "Enforcement is not instantaneous. The API Platform can process a small amount of extra usage while the limit state propagates, so recorded spend can slightly exceed the configured amount."⁸

One thing worth flagging on OpenAI's side: spend alerts and hard spend limits are different products. Alerts notify and let traffic continue; only the "Enforce a hard limit" toggle returns a 429.⁸

In fact, all three dollar-denominated caps behave the same way at the boundary: the work already in flight is allowed to finish. Anthropic lets the in-flight model request complete;¹ Google processes in-flight usage to completion and bills overage from reporting latency "as normal";⁶ OpenAI warns that recorded spend can exceed the configured amount.⁸ None of them is a circuit breaker.

Of the four, AWS is the one that designed around this rather than disclosing it. Its guidance is to write spend rules over request events, not response events — because if you tally only completed calls, "an agent can circumvent the intended limit by issuing many concurrent transfer requests before any one of them resolves."⁵ That is the same in-flight gap the dollar caps leave open, closed by counting work when it starts instead of when it settles.

Don't Confuse This With Task Budgets

Anthropic ships a second, older thing called a task budget, and the two are easy to conflate.

A task_budget on the Messages API is token-denominated and advisory. Claude sees a countdown injected server-side and uses it to pace itself and finish gracefully.¹⁰

Anthropic states the limitation directly: task budgets are "a soft hint, not a hard cap," and Claude may exceed the budget if it is mid-action.¹⁰ They are in beta behind the task-budgets-2026-03-13 header, carry a 20,000-token minimum, and are not supported on Claude Code or Cowork surfaces.¹⁰

So: task budgets shape model behavior. Session budgets stop the platform from issuing requests. Only the second one is enforcement.

What This Doesn't Fix

Four gaps survive all of the above.

These are not the first session-scoped caps. Gateway layers already offered them. LiteLLM's agent iteration budgets, for one, exist explicitly to "control runaway costs from agentic loops with per-session iteration and budget caps," returning a 429 once a session passes its max_budget_per_session.¹¹ What changed in August is that first-party agent platforms started enforcing it themselves, so you no longer need a proxy in the path to get the ceiling.

A cap is not a forecast. Knowing a session cannot exceed $25 does not tell you what 4,000 sessions will cost this month. Anthropic's cap bounds each run separately, by design — including on deployments.¹

Tokens aren't the whole bill. Anthropic's list cost covers model tokens, web searches, and session runtime.¹ It does not cover what your agent's tools spend downstream — the database queries, the third-party APIs, the storage. Google is explicit about the same boundary: a spend cap blocks new usage of the capped service, but ongoing fixed usage tied to persistent resources such as compute and storage "remain active and continue to accrue charges."⁶

Pausing is not resolving. A session that halts at budget_reached has produced partial work and is waiting on a human. That is strictly better than an open-ended bill, but it converts a cost problem into an operations problem — someone has to decide whether to raise the cap or kill the run.

Google's version has a longer tail. A triggered spend cap stays enforced until an administrator manually lifts it, and after lifting, services "might take up to one hour to fully resume normal function."⁶

The Bottom Line

Two major agent platforms shipped run-level spend enforcement a day apart, and they picked different layers to do it — Anthropic in the session object, AWS at the gateway.¹²

Both are answering the number in KPMG's survey: 49% of organizations had delayed or scaled back agent deployments when expected costs began to outweigh anticipated value.³ You cannot approve autonomy you cannot bound.

The honest read is that the ceiling is now real but still soft at the edges. It overshoots by one request, it measures list price rather than your price, and it bounds a run rather than a month. That is a considerable improvement over an alert email, and considerably short of a predictable agent bill.

If you are running agents in production today, the practical move is to set a per-run cap now and treat every trip of that cap as data — either the budget was wrong or the agent was.