Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Execution Budgets, Loop Control, and Circuit Breakers
Budgets for each agent run
Verify that per-execution budgets (e.g., max recursion depth, token use, and monetary spend) are enforced by the runtime.
OWASP AISVS v1.01, requirement 9.1.2
In plain English
Cap every agent run: how deep it can recurse, how many steps it can take, how many tokens it can use and how much money it can spend. Agents loop by accident, and attackers can make them loop on purpose to run up your bill or exhaust your capacity.
What good looks like
- Each run has a maximum number of steps, recursion or delegation depth, token total and cost.
- The orchestrator checks the budget before every step and stops the run when one is reached.
- A stopped run fails safely, with a clear message and a log entry.
- Budgets are set per use case and compared with real usage.
How teams usually do it
- Use the step and recursion limits in your agent framework, and add a token and cost counter that travels with the run, including into sub-agents.
- Set spend limits per API key or project at the model provider as an outer cap.
- Alert when runs approach their budget often, since that suggests a loop or an attack.
Suggested evidence
- Budget configuration.
- Logs of runs stopped by a limit.
- A test with a deliberately looping task.
Common mistakes
- Relying on the provider's monthly cap, which stops everything at once after the money is gone.
- Budgets that reset when the agent hands off to a sub-agent.
- Counting steps and not tokens, so one step with a huge context slips through.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.