Loading…
Open-Policy Exchange
~6 min to deploy
Copilot Token-Budget Guard
Reserves projected model spend before the prompt is forwarded and restrains runs that would blow the project wallet.
For: Agency and platform teams paying for agent runs per client or per project
SOC 2 CC7.2ISO 27001 A.8.9Spend evidence
What it enforces
Project wallet ceiling
Restrains an agent run that would exceed the allocated project token wallet.
Per-task reservation
Escalates a task whose projected cost exceeds the per-task cap before the prompt is forwarded.
Unreconciled-run guard
Restrains a new run while a prior reservation for the same project is still unreconciled.
copilot-token-budget-guard.yaml
# Copilot Token-Budget Guard
# Fork: this is the ai_agency "Token Budgeting" gate, expressed against the
# agent gateway's pre-prompt reservation. Set your own caps.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: copilot-token-budget-guard
surface: copilot
standards: [SOC2-CC7.2, ISO27001-A.8.9]
defaults:
mode: shadow
emit_dossier: true
fail_closed: true
rules:
- name: project_wallet_ceiling
when: "task.projected_tokens != null"
decision: |
RESTRAIN IF wallet.consumed_tokens + task.projected_tokens > wallet.allocated_tokens
ALLOW OTHERWISE
reason_code: project_token_wallet_exhausted
- name: per_task_reservation
when: "task.projected_cost_usd != null"
decision: |
ESCALATE IF task.projected_cost_usd > 25
ALLOW OTHERWISE
reason_code: task_cost_over_cap
- name: unreconciled_run_guard
when: "always"
decision: |
RESTRAIN IF wallet.open_reservations > 0
ALLOW OTHERWISE
reason_code: prior_reservation_unreconciled
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.