Chapter 6 of 8

Operate agency under real resource constraints

Chapter 6

About 5 minutes · includes examples, an exercise, and references

Chapter at a glance

•Separate durable control state from ephemeral workers and make every external effect retry-safe.
•Allocate nested deadlines and multi-dimensional budgets with reserves for verification and cleanup.
•Use admission control, per-tenant concurrency, sandbox isolation, and durable approval receipts.

A prototype loop is synchronous, short-lived, and owned by one process. A production agent may wait for users, survive deployments, call slow dependencies, run code, create artifacts, and consume variable model resources. Production architecture therefore begins by separating control state from compute and by making time, cost, concurrency, and authority explicit resources.

Choose synchronous execution only when the task comfortably fits the request deadline and has no durable side effects that outlive the connection. Otherwise admit the run, return a run identifier, and execute through a durable queue or workflow engine. The client polls, subscribes, or receives a callback. Durable execution does not make code magically exactly once; it records progress so work can resume and uses retryable activities around nondeterministic calls. Application effects still require idempotency and reconciliation.

Persist a run record independently of model conversation state. It contains goal and principal references, phase, version, budgets, current work item, approvals, effect receipts, artifacts, terminal reason, and component versions. A worker leases one step for a bounded interval. If it crashes, another worker can recover after the lease expires. The lease prevents concurrent commits, while effect idempotency prevents duplicate external mutation if the crash happens after a tool succeeds but before state commit.

Time is a hierarchy of deadlines. The product has an end-to-end deadline. Each phase receives a slice. Model and tool calls receive shorter deadlines that leave room for persistence, verification, cleanup, and user communication. A timeout is an uncertain result, not proof of failure. Read calls may be safely retried under policy. Write timeouts trigger receipt lookup or domain reconciliation before a retry.

Budgets are multi-dimensional. Track model input and output tokens, tool calls, external writes, sandbox CPU time, bytes read and written, wall time, retry count, concurrent branches, and monetary estimate. A single scalar cost limit cannot express security or load constraints. Reserve budget before launching parallel work so fan-out cannot oversubscribe. Include cleanup and verification reserves; exhausting the last token on an action without enough capacity to verify it is a design defect.

Latency and quality trade off at several layers. Larger models, broader retrieval, more planning candidates, specialist fan-out, and critic passes can improve some tasks while increasing cost and tail latency. Use a routing policy based on task risk and measured difficulty, not marketing tiers. Begin with a cheaper bounded attempt, escalate on classified evidence, and measure whether escalation changes verified outcomes. Cache stable tool discovery and retrieval where privacy and freshness permit, but never cache an authorization decision beyond its binding and expiry.

Backpressure protects the system and users. Admission control rejects or queues work when model quotas, tool dependencies, sandboxes, or operator review capacity are saturated. Per-tenant concurrency limits prevent a noisy neighbor from consuming all workers. Queues need maximum age and cancellation. A run that starts after its business deadline should expire rather than spend money producing a useless answer. Priority must be explicit and auditable.

Sandboxing is required when tools execute generated code, parse untrusted documents with complex libraries, or manipulate repositories. A container may be sufficient for trusted internal workloads; stronger isolation such as a microVM may be appropriate for hostile code. Whatever the technology, define filesystem mounts, network egress, credentials, syscall or capability profile, resource limits, base image digest, and cleanup. The agent should receive task-scoped credentials with short lifetime, not environment-wide secrets.

Human approval is a durable state transition. The approval request describes the exact proposed effect, parameters, evidence, risk, and expiry. The response identifies the approver and binds to a digest. Editing the artifact or parameters invalidates approval. The workflow can wait without retaining a worker. Denial and timeout are terminal or replanning observations, not text the model can reinterpret as permission.

Availability requires graceful degradation. If retrieval is unavailable, do not let the model answer grounded questions from memory while claiming evidence. If the preferred model is unavailable, a fallback may handle low-risk reads but should not inherit write authority unless separately evaluated. If tracing export fails, buffer locally or mark telemetry incomplete rather than blocking every task indefinitely. Define dependency-specific fail-open or fail-closed behavior from risk, never from a generic retry library.

Deployment needs compatibility discipline. Pin each run to reducer and workflow semantics that can replay its history. New workers must understand active versions, or old workers must drain. Tool schemas evolve with additive fields and deprecation windows. Memory migrations preserve provenance. Canary cohorts compare verified success, unsafe-action blocks, latency, cost, and abandonment. A feature flag that changes authority must be treated as policy deployment with review and audit.

Capacity planning works from trajectories rather than requests alone. Estimate model calls, tool calls, branch factor, sandbox minutes, and human-review demand per admitted run. Tail behavior matters: a small fraction of looping tasks can dominate spend and queue age. Simulate dependency slowdown and quota reduction. Set alerts on budget-exhaustion rate, approval wait age, repeated no-progress states, stale leases, and cleanup failures. The production objective is not maximum autonomy; it is predictable, recoverable completion within declared limits.

Key points

Separate durable control state from ephemeral workers and make every external effect retry-safe.
Allocate nested deadlines and multi-dimensional budgets with reserves for verification and cleanup.
Use admission control, per-tenant concurrency, sandbox isolation, and durable approval receipts.
Version workflow semantics, schemas, policies, and component manifests so active runs survive deployment.

Multi-dimensional budget reservation

Read the expected behavior in the surrounding walkthrough, then copy and run this reference implementation.

Multi-dimensional budget reservationpython

from __future__ import annotations

from dataclasses import dataclass, replace

@dataclass(frozen=True)
class Budget:
    steps: int
    tokens: int
    writes: int
    verify_token_reserve: int = 20

    def reserve(self, *, steps: int = 0, tokens: int = 0, writes: int = 0) -> "Budget":
        if any(value < 0 for value in (steps, tokens, writes)):
            raise ValueError("budget reservations must be non-negative")
        if steps > self.steps or writes > self.writes:
            raise RuntimeError("action budget exhausted")
        if tokens > self.tokens - self.verify_token_reserve:
            raise RuntimeError("verification reserve would be consumed")
        return replace(self, steps=self.steps - steps, tokens=self.tokens - tokens, writes=self.writes - writes)

    def spend_verification(self, tokens: int) -> "Budget":
        if tokens < 0:
            raise ValueError("verification spend must be non-negative")
        if tokens > self.tokens:
            raise RuntimeError("token budget exhausted")
        return replace(self, tokens=self.tokens - tokens, verify_token_reserve=max(0, self.verify_token_reserve - tokens))

budget = Budget(steps=3, tokens=100, writes=1)
budget = budget.reserve(steps=1, tokens=50)
try:
    budget.reserve(steps=1, tokens=35)
except RuntimeError as error:
    print(error)
budget = budget.spend_verification(15)
print(budget)

Worked examples

Toy

A token-and-step budget

A loop may spend at most three actions and one hundred tokens, with twenty tokens reserved for verification.

The scheduler refuses a proposed action whose estimated cost would consume the verification reserve. The terminal reason distinguishes action budget from token budget, making the failure diagnosable.

Budget is reserved before execution.
Verification has protected capacity.
Terminal reason names the exhausted dimension.

Application

Background document investigation

A user submits a document set and returns later for a cited risk report.

Admission creates the run and artifact manifest. Workers parse in sandboxes, retrieve evidence, and checkpoint sections. A human approval is required before sharing sensitive excerpts. The client can cancel, and expired runs delete temporary artifacts.

The web request is not the workflow lifetime.
Artifact access follows tenant policy.
Cancellation reaches workers and cleanup.

System

Multi-tenant agent platform

Many products share model gateways, sandboxes, and tool services under different risk policies.

Admission applies tenant quotas and risk tier. Work queues are partitioned, costs attributed, and credentials minted per task. High-risk writes use a separate worker pool and approval service. Canary releases compare matched tenant cohorts.

Noisy-neighbor limits are enforced.
Authority is policy-specific, not gateway-wide.
Capacity models branch and review demand.

Exercise

Create a production envelope

Turn a synchronous agent demo into a recoverable service with explicit capacity and authority limits.

Define run, lease, approval, artifact, and effect-receipt records plus their retention periods.
Allocate end-to-end, model, tool, wait, and cleanup deadlines and explain timeout behavior.
Set budgets for tokens, calls, writes, concurrency, bytes, sandbox time, and money.
Design degradation for model, retrieval, sandbox, tracing, and approval-service outages.

Success criteria

A worker crash can recover without losing state or duplicating a write.
Every wait has an expiry and every task can be canceled.
Budgets reserve capacity for verification and cleanup.
Fallback behavior never silently expands authority or removes evidence requirements.

Reflect: Which tail behavior would dominate cost or operator load even if median runs look healthy?