Control
Cap what one agent can do in a day
Limit how many requests and how much spend a single agent may raise in a rolling window.
Used in the last hour
Rolling window- Requests raised36 of 50
- Spend asked for£4,100 of £10,000
- Critical actions0 of 2
Limit
- Agent
- refund-agent
- Window
- 60 minutes
- At the limit
- Pause the agent
- Attestation
- Signed hourly
If the agent loops
- Request 50 raised
- Request 51 refusedlimit reached
- Owner told in Slack
- Signed note of what was refused
Why it matters
What blast-radius limits changes
- Set request and spend limits for each agent.
- Limits count over a rolling window.
- At the limit, the agent is paused and the right person is told.
- One runaway agent can raise thousands of requests.
- Spend has no ceiling until the invoice arrives.
- You find out after the damage is done.
The resultA cap on your worst day.
What you get
Blast-radius limits, in practice
Requests and spend
Two dials per agent: how many, and how much money.
Enforced as it happens
Checked when the request is created, so two at once cannot both slip through.
Signed attestation
Export a signed statement of the limit and how full it is, for an auditor or insurer.
How it works
Step by step
- 1
Set a limit
For one agent, over a rolling window.
- 2
Request arrives
The count and the spend are checked at once.
- 3
Over the line
The request is refused.
- 4
Recorded
Every refusal is kept in the log.
Questions
About blast-radius limits
What is a rolling window?
A moving period, such as the last 24 hours, not a calendar day that resets at midnight.
Can an owner change a limit?
Yes, and you can require a second owner to agree first.
Next
Works well with
Know what your agents did.
Start free. Guard your first agent in a few minutes, and keep a record anyone can check.
- Free plan, no card
- Signed, chained decisions
- Checked offline, without us
Signed decision
- Decision
- Approved, 2 of 2
- Action
- refund.issue, £540
- Rule
- Two reviewers must agree
- Sealed
- 14:09, key 7f2c
- Hash
- 5be2…7c44
Checked on your own machine
- Signature matches the public key
- Decision is in the log
- Every link before it adds up