Stop the whole estate
An administrator trips a global stop from the central console. The decision fans out through federation and freezes execution on every node without redeploying or changing agent code.
MCP firewall capability
Runtime Limits & Circuit Breakers
An agent that has passed authorization can still cause damage simply by acting too much, a single approved call, repeated in a tight loop or escalated across thousands of records, becomes an operational and financial incident. Runtime Limits is the outbound governor: it reads real in-memory counters on every call and trips a deterministic breaker the moment velocity, spend, or cumulative scope crosses a configured limit. A scoped kill switch can freeze execution across the estate, and recovery runs through Session Rewind.
Govern what an agent does on the way out
An authorized call enters the governor and is measured against the active breakers. Within limits, it proceeds; over a limit, the breaker trips. A scoped kill switch overrides everything, and a tripped call hands off to recovery.
Authorized callA tool call that has already cleared capability, intent, and policy checks and is about to reach an API, database, or microservice.
Circuit breakersVelocity/rate over a native rolling window, spend against the Redis budget store, and a call-count/scope ceiling, all read from in-memory counters.
Allow · or tripWithin limits the call is forwarded; over a limit the breaker trips, the call is blocked, and recovery is triggered.
Redis budget store + native rolling windowPer-session counters for spend and call frequency. State is available immediately, so the breaker decision is local and deterministic.
Outbound check
Read, evaluate, then allow or trip
Runtime Limits runs on every tool call as a set of deterministic, local checks with no LLM in the path. Because they run against in-memory state, they add only sub-millisecond deterministic overhead and stop a runaway agent in the same moment it misbehaves.
Read the counters
Per-session counters are held in a native rolling window and a Redis-backed budget store, so the current state of a session is available immediately.
STATEVelocity / rate breaker
If call frequency crosses a threshold, for example more than N calls in a ten-second window per session, the breaker cuts the wire before a loop can flood a downstream API.
−RATESpend / budget cap
Monetary and cost limits are debited per session, user, or tenant. When the ceiling is reached, execution stops, a bug becomes a blocked call rather than an open-ended invoice.
−SPENDCall-count / scope ceiling
Cumulative execution is tracked across the session and halted when the authorized scope is exceeded, so a narrow grant cannot quietly widen into a bulk operation.
−SCOPEForward or trip
Within limits the call proceeds upstream. On a breach the breaker trips: the call is blocked and recovery runs through Session Rewind.
ALLOWThe kill switch and recovery
Beyond the per-call breakers, an operator has an instant stop, and a tripped call does not simply crash the workflow, it hands off to recovery.
Stop one tenant
A tenant-scoped stop halts calls for a single tenant while the rest of the estate keeps running, so an incident in one boundary does not force a full outage.
Stop one agent
An agent-scoped stop freezes a single misbehaving agent. When a breaker trips, recovery and inoculation run through Session Rewind so the workflow resets instead of crashing.
What Runtime Limits actually does
Stated plainly, without overclaiming. The breakers are real and shippable; the parts that are optional or on the roadmap are marked as such.
Real breakers on real counters
The velocity/rate breaker, the spend and monetary budget caps, and the call-count/scope ceilings run on real in-memory counters, a Redis budget store plus a native rolling window. Enforcement is deterministic and adds only sub-millisecond deterministic overhead.
A real, scoped kill switch
The kill switch is real and can be scoped globally, per tenant, or per agent. Federation lets that decision fan out across nodes. When a breaker trips, recovery runs through Session Rewind.
The event stream is optional
The ig.circuit.v1 circuit-breaker event is emitted onto an optional Kafka stream, an available enterprise-tier sink, opt-in and never an inline dependency. The local breaker works whether or not that stream is wired up.
No payload-inspection engine
There is no dedicated byte-size payload-inspection engine. Mass exfiltration is bounded by burst and rate limiting and by policy row-ceilings, the rate and volume controls that actually ship. Following the golden rule, customer payloads never leave the local boundary.
Related capabilities
Governing how much an agent may do is the outbound layer of the MCP firewall. It composes with the controls that clean what the model reads, decide whether a call should fire, and prove what happened.