- Home
- AI agents
- Guardrails
- Approval gates and limits
Govern and secure · Guardrails
Approval gates and limits for AI agents: what to gate, what to cap and how to enforce it
An approval gate stops an agent before a specific action until a rule or a named person allows it. A limit caps how much the agent can do without asking: tokens, model calls, steps, run time, transaction value or rate. Both belong outside the model, in code or policy the model cannot talk its way past.
In this guide: 83 pages
Key takeaways
- Gates and limits answer different questions. A gate asks whether this one action may happen; a limit asks how much the agent may do before anything is asked at all.
- Write gates as deterministic policy wherever a rule can decide. AgentCore Policy checks every tool call against Cedar rules at the gateway, so a person is needed only for the calls a rule cannot settle.
- Cloud budgets are delayed controls. Azure evaluates budgets every 24 hours and does not stop consumption, and AWS Budgets actions work from data that updates up to three times a day, so runaway loops need real-time caps on tokens and steps.
- Decide what happens on a timeout before you need it. Copilot Studio external threat detection allows a tool call if the provider does not answer within one second unless you set it to block.
Which actions need a gate and which need a limit?
Gate actions that are irreversible, move money, change access or send data outside the company. Limit everything else by volume and time, because the damage from routine actions comes from repetition, such as a loop that runs all night.
Action types, with the gate and the limit we would set for each.
| Action type | Example | Gate | Limit |
|---|---|---|---|
| Read within the user's rights | Search policies, summarise a ticket | None | Tokens per minute; model calls per run |
| Write that can be undone | Draft a reply, update a ticket field | None, or sampled review afterwards | Writes per run; writes per hour |
| Outbound communication | Send an email outside the company | Approval, or an allow list of recipients | Messages per hour |
| Money or contractual effect | Issue a credit note, approve a purchase | Policy below a threshold, a named person above it | Value per transaction and per day |
| Irreversible or destructive | Delete records, reset a system | Approval, with disclosure of what will happen | One per run; production blocked by default |
| Prohibited | Change its own permissions, switch off logging | Never allowed | Not applicable |
Microsoft's illustrative taxonomy for agent red teaming has three tiers: prohibited actions are never allowed, high-risk actions such as financial transactions need human-in-the-loop confirmation, and irreversible actions such as deletions need disclosure plus confirmation. The threshold in the money row is our own design choice for small amounts and goes further than that default, so agree it with your risk owner. The human-in-the-loop page in this guide covers the approval patterns themselves.
Which limits should every agent have, and where do they hold?
Every agent needs a cap on model calls per run, a token rate and quota, a maximum run time and, for agents that move money or send messages, a value or count cap per day. Each one holds only where it is enforced in real time, which rules out the monthly cloud budget.
Step caps live in the agent code. The OpenAI Agents SDK takes a max_turns value and raises MaxTurnsExceeded when a run passes it; passing None switches the cap off, and an error handler can return a controlled final answer instead of failing. LangGraph raises GraphRecursionError at its recursion_limit, whose documented default is about 10,000 steps in current versions, far above what a business task needs. Set the cap from observed runs, a little above the longest successful run you have seen.
Token caps live in a gateway. Azure API Management's llm-token-limit policy sets tokens per minute, answered with HTTP 429, and a token quota per hour, day, week, month or year, answered with HTTP 403, keyed by subscription, IP address or any expression you choose. Give each agent its own counter key so one agent's loop cannot starve the others. Counting is per gateway and not aggregated across regions, and concurrent requests can briefly exceed the limit.
Time caps come from the runtime and the workflow. AgentCore Runtime sessions run up to 8 hours on microVMs or 14 days on Instances; AgentCore Browser sessions default to 15 minutes. A Step Functions task waiting for an approval can sit for the full one-year execution quota unless you set HeartbeatSeconds.
Spend caps arrive late. Azure budgets are evaluated every 24 hours, with data typically 8 to 24 hours old, and they do not stop consumption. AWS Budgets can apply actions such as IAM policies, but its data updates up to three times a day. Copilot Studio is the exception that cuts the other way: agents are blocked at 125% of prepaid capacity, even mid-conversation, unless pay-as-you-go billing is attached.
How do you write a gate as policy instead of a prompt instruction?
Put the rule in a policy engine at the tool gateway or in the tool's own validation, where it reads the caller's identity and the call's arguments and the model cannot change it. A sentence in the system prompt is a hint the model may ignore or an attacker may override.
AgentCore Policy (GA 3 Mar 2026) shows the pattern. It checks every agent-to-tool request at AgentCore Gateway against Cedar policies, written directly or converted from natural language, and works for APIs, Lambda functions, MCP servers and third-party services. AWS's launch example allows a tool that pays money back to customers only for an identity holding one named role and only below a set amount. Since July 2026 the same layer can also apply Bedrock Guardrails checks.
Run every new policy in log-only mode first, compare its decisions with what a reviewer would have decided, then switch to enforce. Elsewhere the equivalents are newer: Microsoft Foundry guardrails can intervene at the tool call (preview), Copilot Studio external threat detection is called before every tool invocation (preview), and Google added semantic governance policies on tool calls at Agent Gateway (preview, 29 Jun 2026).
The reason to move rules out of prompts is measured. In "The Attacker Moves Second" (10 Oct 2025), researchers bypassed 12 published defences against jailbreaks and prompt injection, most with attack success above 90%, although most had reported near-zero. A threshold written in Cedar or in the tool's API does not depend on the model reading it correctly.
What should happen when a gate or limit cannot decide?
Fail closed for anything gated, and stop cleanly with a plain message when a limit is hit. Then alert the owner, because a limit that fires is the earliest sign of a loop, a bad input or an attack.
- Timeouts count as a deny. Set a timeout on every approval wait and make deny the default, with heartbeats where the engine supports them.
- Security checks block when the checker is down. Copilot Studio external threat detection allows the tool call after one second without an answer unless you choose Block the query; for agents with write access, choose it.
- Retries respect the cap. Back off and retry on a 429 rate limit, but treat a 403 quota response or a step cap as a stop, or a small fault becomes a large bill.
- Users hear what happened. The agent says which limit it hit and leaves the work in a state a person can resume, so nobody reruns a half-finished task blind.
How do Microsoft, AWS and Google implement it?
Where gates and hard limits are enforced on each cloud, as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Policy gate at the tool call | Foundry guardrails at the tool call intervention point (preview); Copilot Studio external threat detection (preview) | AgentCore Policy with Cedar, enforce or log-only (GA 3 Mar 2026) | Agent Gateway; semantic governance policies on tool calls (preview 29 Jun 2026) |
| Human approval step | Foundry MCP tool require_approval; Copilot Studio multistage approvals (preview) | Step Functions .waitForTaskToken; Bedrock Agents Classic user confirmation | ADK require_confirmation (experimental) |
| Real-time token and run caps | API Management llm-token-limit per counter key; Copilot Studio capacity enforcement at 125% | AgentCore Runtime session limits; step caps in your framework code | Step caps in your framework code; no platform token quota verified for this page |
No first-party per-agent spend cap was verified on any of the three clouds for this page; cloud budgets alert after the fact.
Enterprise example · Worked example · illustrative
A retailer puts gates and limits on a customer credit agent
Illustrative: a 1,500-person online retailer with an agent that issues goodwill credits from the support chat. The numbers are invented to show the design.
A Cedar policy at the tool gateway permits the credit tool for the agent's role when the amount is under the policy threshold and the order is less than 30 days old. Above the threshold the call goes to a named person in the payments team through a Step Functions callback with a four-hour heartbeat, and a timeout counts as a deny.
Limits sit around the gates: 12 model calls per conversation through the SDK's turn cap, a per-agent token quota at the API gateway, and a daily credit total that blocks further credits until the next day. In the first month the turn cap fired on 0.4% of conversations, all loops on one malformed order format, which the team fixed in the order lookup tool.
- Owner
- Head of customer operations; a payments team lead as approver
- Identity
- AgentCore workload identity; each credit logged under the agent with the customer ID
- Risk tier
- High, because the agent moves money to customers
- Approval
- Policy below the threshold, a named approver above it, deny on timeout
- Limits
- 12 model calls per conversation, a per-agent token quota and a daily credit total
- Retirement
- Reviewed each quarter; retired if credits move into the order system
Frequently asked questions
Should every tool call need approval?
No. Gating every call trains reviewers to click yes and slows the agent to the speed of the queue. Gate by tier and threshold, let reads within the user's rights run, and use limits for volume. The human-in-the-loop page in this guide covers approval fatigue in detail.
What is a sensible step cap for an agent?
One taken from your own runs. Look at the number of model calls in successful runs over a week and cap a little above the longest. Framework defaults are far higher, since LangGraph documents about 10,000 steps, and a cap you never hit in testing will still catch a loop in production.
Can a prompt instruction act as a limit?
Only as a hint. An instruction such as "never credit more than the order value" can be overridden by injected text or simply missed. Put the rule in a policy engine or in the tool's own validation, where the model cannot change it, and keep the prompt instruction as a second line.
What should an agent do when it hits a limit?
Stop, tell the user or the owner in plain words which limit it hit, and leave the work where a person can resume it. Retrying a 429 with backoff is fine; retrying past a quota or a step cap is not. The OpenAI Agents SDK lets an error handler return a controlled final answer when max_turns is reached.
More in Guardrails
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Policy in Amazon Bedrock AgentCore is now generally available
- Amazon Bedrock AgentCore adds quality evaluations and policy controls
- AgentCore release notes
- Host agents with AgentCore Runtime
- AgentCore Browser
- Wait for a callback with a task token (Step Functions)
- Managing your costs with AWS Budgets
- Limit large language model API token usage (llm-token-limit)
- Create and manage budgets
- Billing rates and management (Copilot Studio)
- External threat detection for Copilot Studio agents
- Guardrails and controls in Microsoft Foundry
- Connect to Model Context Protocol servers (Foundry Agent Service)
- AI Red Teaming Agent
- Gemini Enterprise Agent Platform release notes
- Tool confirmation (ADK)
- Running agents (max_turns)
- Graph API overview (recursion limit)
- The Attacker Moves Second
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner