Problem 4 of 15 in the Harnessing Agentic AI Systems series — read the index for the framing. Previous: Human-in-the-Loop Breakpoint Pattern · Next: Rolling Window Compression Pattern.
The Problem — Bounding the loop
Loops can burn unbounded tokens, wall-clock, and money retrying a broken step. The ceiling must be enforced by the system, never requested of the model — the enforcement half of the Bill as Assertion.
| Field | P4 — Token & Time Budget Throttler (pattern) | A2 — The Infinite Execution Vortex (anti-pattern) |
|---|---|---|
| Forces / Smell | Long-horizon work vs unbounded consumption; structural enforcement vs prompt-based; bill shape vs budget. | No ceiling on iterations, tokens, time, or money; the same failing step retried; the loop "working on it." |
| Solution / Anti-solution | Monitor continuous tool loops and forcefully terminate agents beyond maximum token costs or time boundaries. Enforce in the harness, never in the prompt. | "It'll converge" — trust the model to stop. |
| Consequences / Failure | The vortex cannot happen: the bill is bounded by construction, and the system — not the model — owns the ceiling. | Unbounded token drain; an economic failure before a technical one — the tragedy of the commons staged inside one run. |
| Tradeoffs / Refactoring | A budget too tight kills long-horizon work; too loose is theater. The throttler can invalidate the warm prefix it protects and raise the bill it caps. Choose the "exceeded" metric — spend, per-step, wall-clock, iterations. | P4 enforced in code — OWASP LLM10, loop-iteration limits; reminders are not enforcement (DeepSeek's runaway-loop guard "only sends reminders and eventually goes quiet"). |
| Evidence | AutoGPT's iteration and cost limits (docs); OWASP LLM10:2025 Unbounded Consumption; token economics — prices down 98%, consumption up ~150x, bills tripled (Every Token Has a Price Tag). | AutoGPT's open issue tracker (issues); Every Token Has a Price Tag. |
| Related | Refactoring for A2; composes with P3; connects to the bill-as-assertion pattern. | Is the absence of P4; is the single-loop form of A10. |
Discussion
This problem is the economic face of the harness: it decides the shape of the bill when the model cannot be trusted to — "the caps were about the shape of the bill, not the money" (Every Token Has a Price Tag). The subtle interaction distinguishes a good throttler: it must not invalidate the warm prefix it exists to protect. And the honest limit is documented: soft enforcement is not enforcement.
Key Insight
The bill is a design decision and the ceiling is a system property. Reminders are not enforcement, and a throttler that kills its own cache prefix is the failure it was meant to prevent. Enforce in code, never in the prompt.
References
AutoGPT configuration (docs) and issue tracker (issues); OWASP Top 10 — LLM10 (2025); archive: Every Token Has a Price Tag, DeepSeek teardown.