AI agents need cost controls at the agent-run and model-call boundary, where loops, subagents, and growing context create spend.
2
Token Ops combines attribution, budgets, developer-approved actions, and policies that can steer a run before resorting to a hard halt.
3
In benchmarks on Browser Use and MetaGPT, the full policy suite reduced average spend by almost 78% and increased completion from 67% to roughly 96% compared with simple throttling.
Summary
Tisha Chawla and Susheem Koul describe Token Ops, a control plane for managing the cost of AI agent runs. They argue that SaaS and cloud systems gained usage caps, autoscaling, and related controls, while agent systems still lack controls where code calls a model. The design attributes model-call cost to runs and user-defined dimensions, records it in a ledger, and applies budgets over time windows. Developers annotate existing methods with a boundary and configure a governor that limits which actions the control plane may perform. Policies can halt a run, or steer it by changing agent behavior, such as reducing tool output or asking a model for more concise responses. A preview mode lets teams evaluate policies before enforcement. Tests on Browser Use and MetaGPT reduced average spend by almost 78% and raised completion from 67% to roughly 96%.
Agent spending needs a control surface at the model-call boundary
Chawla frames the problem as a move from token maxing to value maxing. SaaS products gained controls such as usage caps, seat limits, and tier policies. Cloud systems added pay-as-you-go pricing with autoprovisioning and autoscaling policies. In agentic systems, cost is created through model calls, but the speakers say there is no comparable control plane at the point where code calls the model. Unbounded consumption, runaway loops, and large context growth can therefore create major bills without a clear link to the responsible run.
Cost attribution must reach the agent run before policies can act
The speakers start from three design principles. Tokens are the unit of cost, so value and usage need to be measured in token terms. Cost is created at the LLM call boundary, which makes that boundary the place to track activity. Each call also needs attribution to an agent run or another owner. Without that link, a team can see that something went wrong but cannot narrow the bill down to a particular agent or run. Once the responsible run is known, policies can address an excessive loop or a context that is growing beyond what the task needs.
In-place steering should come before stopping an agent
Chawla says a budget cap should be the last resort. If a loop is running too often or context is expanding, the system should first apply an in-place policy that addresses the cause. Examples include compaction or caching. This differs from controls that only stop a request after it has crossed a threshold. The proposed platform uses cumulative budgets across attributed runs and enforces actions in the call path, so it can change behavior while the run is still active.
The SDK connects existing methods to a control plane without a rewrite
Koul describes three layers: the agent runtime, a bridge, and the control plane. A boundary annotation can be added to an existing method regardless of the framework. It tracks the method's input and output, sends that information to the control layer as a ledger entry, and provides a channel for actions to travel back to the agent. A governor receives those actions and applies only the changes the developer has authorized. The speakers also describe wrap complete for model providers that expose objects instead of methods. The control plane runs in the customer's own tenant.
Segments let teams budget groups of runs at different levels
The control plane uses dimensions emitted by the attribution layer to create segments. Koul gives a cohort tag such as AIE 2026 as an example. A budget can then apply to that cohort rather than only to one agent or one run. The system supports rollups and finer-grained control. Budgets are static thresholds over a time window for a segment or run. Policies combine segments, budgets, and actions so the control plane knows where and when to enforce them.
Steering preserves a run when a hard halt would only reduce the bill by killing it
The action model has two broad types. Halt actions kill an agent after it exceeds a budget. Steer actions change the behavior of the agent or one of its components so the run can fit within the remaining budget. Koul gives retrieval as an example: if a RAG tool returns 20 chunks but the model rarely uses chunks after the first five, the control plane can ask the tool to return fewer. The governor applies this kind of change only when it is included in the developer's allowed configuration.
Cost guard uses both budget consumption and token velocity
In the demo, cost guard watches how much of the allocated budget has already been consumed and the velocity at which tokens are being consumed. If those signals predict that the run will exceed its budget before completion, the system injects an instruction into the system instructions. The instruction can ask the model to produce more succinct or summarized outputs. This is the steering path. It attempts to finish the run under budget instead of using a circuit breaker immediately.
Preview mode gives teams a way to test policies before enforcement
The demo begins with a two-agent workflow: a research agent can search the web repeatedly, then passes its findings to a summarizer that writes a research report. In preview mode, policies evaluate and appear in the dashboard, but their actions do not execute. The run completes while governance is off. The speakers present this as a way to put the system into a production agent, inspect what the policies would do, adjust guardrails, and settle thresholds before turning enforcement on.
The policy catalog can grow from the ledger of failures
The benchmark policy catalog covers spend management, context compaction, tool-output reduction, loop detection, and progress detection. Its actions include halt operations and steer operations such as allow, mutate, and inject. Koul describes a longer-term plan for a self-learning module in the control plane. It would inspect the continuously updated ledger to find failure modes that current policies miss. The module could generate policies for those gaps or refine parameters in existing policies so future runaway costs are handled more effectively.
"The average spend goes down by almost 78% with token ops enabled with the full policy suite that we have today."19:03
Who should watch
You run agents in production and cannot trace model spend back to a particular run, cohort, or agent.
Your current cost control is a gateway cap or model downgrade, and you want policies that can change an active run before killing it.
You are introducing agent guardrails and need preview mode to test policy behavior before enforcement.
