A new deterministic spend gate for AI agents denied 35 of its first 43 decisions, proving that most agent failures are identity and configuration errors rather than budget overruns. The system, deployed on a local proxy at http://127.0.0.1:8899, blocks any request lacking a valid SHA-256 token digest before it reaches the provider. This approach shifts the focus from reactive invoice monitoring to proactive, atomic budget reservation and fail-closed enforcement.

The Architecture of Denial

The gate operates by intercepting six agents configured to point at the local proxy, ensuring they never hold the real API keys. Before any call leaves the host, the system checks identity against a vault, enforces per-request caps of EUR 0.50, and reserves worst-case costs atomically. If a token is missing or unscoped, the request is denied immediately. Of the 35 denials, 33 were caused by bad_or_unscoped_token errors, indicating that agents often lack proper credential mapping during initial setup.

Auditor Findings and Enforcement Gaps

A separate audit revealed that the current nftables rules are insufficient for true enforcement. While the gate blocks a dedicated service UID, the worker-spawning lane uses passwordless sudo and Docker group membership, allowing it to bypass the proxy and read real keys directly. The auditor’s verdict labeled this slice as defence-in-depth rather than hard enforcement. Additionally, alerting is currently file-only, with denials written to alerts.jsonl but no active notifications sent to humans.

Ledger Integrity and False Positives

The system uses an append-only JSONL ledger with hash-chained records to prevent silent edits. However, the audit found that test harness rows contaminated the production ledger, including one instance where a 401 upstream error still consumed EUR 0.03 in estimated spend. The ledger currently holds 43 records, with only six representing real, valid agent interactions. The author notes that cost tracking remains an estimate until provider rates are precisely synchronized, highlighting the gap between theoretical caps and actual billing.

Key Takeaways

  • Identity verification is the primary failure point for new agent deployments, accounting for 33 of the 35 initial denials.
  • Atomic budget reservation prevents race conditions where multiple agents might jointly exceed a cap.
  • Network-level enforcement requires strict UID isolation; sudo and Docker groups can bypass proxy gates.
  • Alerting mechanisms must be active, not just passive file logs, to be operationally viable.

The Bottom Line

The deny path is the product. While the gate successfully blocked 35 of 43 requests due to malformed credentials, calling it 'enforcement' is a lie until the host architecture fixes the sudo and Docker bypasses. Until then, this is defence-in-depth, not a cage.