Where should an AI agent’s spending authority actually live?

I've been thinking about agent budgets less as a FinOps feature and more as an authorization problem. An agent can decide: “I need another model call.” The interesting question is: Who gets to say whether it's allowed to spend another $2? Putting a token limit or max_iterations inside the agent runtime is useful for bounding execution. But that's still the agent regulating itself. I'd rather have the runtime ask for the resource, and have something outside the agent enforce the spending policy. Agent ↓ "I want another model call" ↓ Policy / Gateway ├─ identity ├─ remaining budget ├─ rate limit └─ model policy ↓ ALLOW / REJECT That distinction becomes more useful once multiple agents, versions or teams are sharing the same model providers. You don't really want every agent implementation inventing its own notion of “I can spend up to $X.” This is one of the reasons I find Lyzr Open Controller's approach interesting. Its LLM Gateway puts budgets at the organisation, team, agent, version and virtual-key levels, and the important part is that an exhausted budget rejects the call rather than just generating an alert. LiteLLM, Portkey and OpenRouter solve a lot of the gateway/proxy problem too, so I'm curious where people draw this boundary in their own stacks. Should spending be an attribute of the agent itself, or an external authorization decision that the agent has to pass through? Especially interested in how this is handled when several agents share providers or when model routing changes underneath them.