Apply usage ceilings to every agent and every tool: maximum number of calls per session, maximum cost incurred per session (for paid APIs), maximum rate of calls per minute, and maximum data volume transferred.

When a ceiling is hit: automatic throttling or suspension, not silent failure. The agent pauses, the operator is alerted, and the session is flagged for review before resuming.

"Adaptive" means the ceiling adapts to context — a batch processing task legitimately needs more API calls than an interactive query. Define budgets per task type, not a single global limit.

Tool budgeting is primarily a defense against loop amplification (S09) and cost-based DoS. It doesn't prevent a single high-impact tool call from succeeding — a one-shot exfiltration or a single fraudulent refund happens within any reasonable budget. Budgets catch runaway behavior, not precise attacks.

S09 (Loop amplification / API DoS) — directly blocked. S06 (DNS exfil via repeated ping) — repeated DNS calls would exceed the ping call budget. Also provides a tripwire for any scenario where an attack requires many tool calls to complete.