Enforcement Modes
Your agents: Observe / Control. External agents: Admit (Charge policy). These are lanes, not a progression.
Observe
Log everything, block nothing. See every tool call and its computed cost in the Shadow Report. Agents run unimpeded.
✓ Free · No risk · Start here
Control
Set budgets and get alerts. A tool call the budget can't cover is refused.
JSON-RPC error -32000: "Budget exhausted" when nothing is left, or "Insufficient budget" when the call costs more than what is left.
Admit (Charge policy)
Admit paid external agents. Requests are admitted under a charge policy: verified, priced, and paid before protected work runs.
Coming for MCP tools
Your agents, then budgets
For your own agents, move from Observe to Control when you want budgets enforced. Admit is a separate lane for external agents, not the next step.
- Start in Observe: connect agents, see tool calls in the MCP Monitor, review the Shadow Report. No budgets needed. This alone gives you visibility you didn't have before.
- Set tool costs: in the MCP Cost Profile, assign credit costs to each tool. The Shadow Report will show what agents would have spent.
- Create budgets: delegate tokens with budgets. Still in Observe, so budgets are tracked but not enforced.
- Switch to Control: enforce budgets. A tool call the budget can't cover gets JSON-RPC error -32000. No token, no spend.
How to change modes
Open MCP Cost Profile in the dashboard. The enforcement mode selector is at the top of the page. Changes take effect immediately.
What agents see
| Scenario | Observe | Control |
|---|---|---|
| Tool call within budget | ✓ Pass | ✓ Pass |
| Budget exhausted | ✓ Pass (logged) | ✗ Refused: JSON-RPC error -32000 |
| No budget set | ✓ Pass | ✓ Pass |
Credit budgets are enforced on MCP tool calls only in Control mode. On HTTP, they are enforced on Control routes, on kind: pay routes, and on kind: capability routes that set a positive costCredits, a positive pay.price, pay.enforceBudget: true or a Control pay.mode. An Observe route never refuses a call because a token's budget ran out, whatever cost or budget settings it has. Where budgets are enforced, an HTTP route answers HTTP 402, and a refused tool call gets JSON-RPC error -32000: "Budget exhausted" when nothing is left, or "Insufficient budget" when the call costs more than what is left. In Observe, the call is recorded and goes through.