Action budgets and resource quotas

Control objective

This control checks that each agentic task runs under explicit action budgets and resource quotas, so an autonomous agent cannot loop indefinitely, make excessive tool or API calls, or consume runaway compute, memory, or tokens - a real risk in banking agents that can otherwise rack up cost, hammer downstream core-banking systems, or take redundant actions while trying to complete a task. The control enforces hard ceilings on how much an agent may do per task and watches consumption against them. To implement it, instrument the agent runtime to count calls, compute, memory, and token usage per task; attach a quota to each task at dispatch; meter usage continuously; and log consumption and any enforcement events as evidence for audit. No separate metric or formula is defined, so operate it directly against the stated thresholds: set hard caps on calls, compute, memory, and tokens per task, alert when usage reaches 80% of any cap, and auto-terminate the task when it hits 100%. The 80% alert gives operators a chance to intervene before work is lost, while the 100% auto-termination guarantees a runaway agent is stopped safely. A breach should halt the task, free its resources, and surface the event for review of whether the cap or the agent's behaviour needs adjustment, aligning with IBM Redundant Actions guidance and MAESTRO L4.