Budgets and stops
A release breaks at 2 a.m. and three agents are still working, each spending on the team's model key. Oxagen refuses metered calls past a spend ceiling you set, holds a run to the limits in its mandate, pauses live runs when a person asks, and ends an agent's authority at the scope that fits.
At 50, 80, and 95 percent of a ceiling, Oxagen notifies the organization's admins. At 100 percent it refuses the next metered call until someone raises the ceiling or the period ends.
A spend ceiling through one period
- 50 percentAdmins are notified
- 80 percentAdmins are notified
- 95 percentAdmins are notified
- 100 percentThe next metered call is refused
Share of the ceiling spent this period
How spend ceilings work
Set spending boundaries on supported calls through Oxagen. A spend ceiling covers one organization or one workspace. It counts spend over the calendar month to date, or over a trailing window of days you choose. You decide whether it is enforced or only watched.
When an enforced ceiling is reached, Oxagen refuses the next metered Oxagen call before any model provider is paid, and the run's people are told why it is waiting. Raising the ceiling clears the refusal. An organization Owner or a Compliance and Billing member sets either ceiling, a workspace Admin sets that workspace's own, and each change is audited.
On an enrolled machine, model calls go from the recorder's local proxy to the provider, so the ceiling does not refuse them. The per-run and daily limits in the agent's mandate do, for Claude Code, Codex, and Stella.
If Oxagen cannot read the spend store, the ceiling lets the call through and raises an internal alert. A scope already known to be spent stays refused.
Agent budgets
Each agent can also carry a budget in cents. The agent budget is not a ceiling by itself. Your policy rules read what is left of it, so a rule can stop a call once a run has spent most of the budget. An agent with no budget has no limit of its own.
Spend controls
| Control | Scope | Stops work by itself |
|---|---|---|
| Spend ceiling | Organization or workspace | YesWhen enforced. The next metered call is refused. |
| Agent budget | One agent | PartialA policy rule must read it. |
| No-progress limit | Workspace | PartialPauses a run after a set number of identical calls in a row when enforced. The default only records it. |
Pause and revoke controls
Pause a live wrapped run, or end authority for an agent, a tool, a connection, or a workspace. Oxagen records each stop with its reason.
A pause holds work and keeps authority. oxagen run pause-all --reason pauses every live wrapped run in a workspace as one recorded decision. Each run stops at its next stopping point after its host collects the command, and the answer lists each run it skipped, such as one whose host is offline.
A kill switch denies the next governed call at its scope: a tool, a tool server, a connection, an agent, an operator, a workspace, the organization, or a class of consequence. A connection switch also revokes the connection's live credentials. Suspending an agent empties its tools until someone resumes it, and revoking a machine's enrollment refuses every run on that machine at its next step.
How a stopped run behaves
A person asks for a pause, the run's host collects the command, the run stops at its next stopping point, and the run waits until someone resumes it. Each state is recorded separately.
One pause from request to resume
- Pause requestedReachedRecorded with its reason
- Host collected the commandReached
- Run stopped at its next stopping pointReached
- ResumedPending
Coverage by control
| Control | Covers | Leaves out |
|---|---|---|
| Spend ceiling | Metered Oxagen calls in its organization or workspace, including calls made with an API key | Model calls an enrolled machine sends to its provider. Cursor's model calls. Oxagen's in-app agent. |
| Mandate run and daily limits | Model calls through the recorder's local proxy for Claude Code, Codex, and Stella | Cursor's model calls, which skip the proxy. |
| Kill switch | The next governed call at the switch's scope | Calls made with an API key, which roles and key revocation govern. Oxagen's in-app agent, which has its own switch. |
| Run pause | Live wrapped runs in the workspace | A run whose host is offline, until the host collects the pause. |
Billing terms
A ceiling counts the spend Oxagen recorded. It is separate from your model provider's bill, from Oxagen's own plan, and from your credit wallet. Read the pricing terms for seats, allowances, and credits.
Product walkthrough
Set a ceiling on a sample workspace and watch the point where it takes effect.