What happens when an LLM loop runs away: the guardrail pattern
Nobody budgets for the runaway loop. Every AI SaaS has a line item for "expected LLM spend" and nobody has a line item for "the Friday night a bug turned our agent into a money printer." I've seen the second one. Here's the pattern that prevents it. The scenario You ship a "deep research" agent endpoint on Friday at 6pm. It works like this: the agent plans, calls tools, reads results, and loops…
When building AI SaaS applications, it's easy to overlook the financial implications of a runaway loop. A common scenario involves shipping a deep research agent endpoint on a Friday evening. The agent plans, calls tools, reads results, and loops until its verifier step returns "done: true." However, if a customer pastes a URL that the fetcher tool can't parse, the verifier will keep returning "done: false" because the evidence field is empty.
Without a cap on iterations, the loop continues without stopping. This can go unnoticed until the next Monday.
To prevent such runaway loops, a guardrail pattern can be implemented. This pattern involves four key components: pricing every call before execution, maintaining a pre-aggregated spend ledger, checking before each call in middleware, and using a kill switch.
Firstly, pricing every call is crucial. Maintain a pricing table per model, versioned in code. If an unknown model is encountered, either refuse the call or price it at the most expensive known rate. Silent pricing of $0 could lead to unlimited usage. The estimate_cost function calculates the cost based on input and output tokens using the pricing table.
Secondly, maintain a pre-aggregated spend ledger. Don't sum usage events on every request, as this can be slow and cause the guardrail to be skipped. Instead, store one row per API key per day and per month, updating it after each call. The cost before each call can then be checked using a single indexed row lookup, which is fast and reliable.
Thirdly, implement the guardrail check in middleware. This enforcement point should be placed once, not sprinkled across every agent implementation. The middleware checks for a global spend pause flag in Redis, looks up the spend ledger for the API key, and compares the estimated cost against the daily or monthly cap. If the cap is exceeded, appropriate exceptions are raised, and a warning is logged. The enforcement mode can be set to hard cutoff (the call is never executed) or warn mode (the call is allowed but logged).
Lastly, use a kill switch to stop all LLM spend instantly. A single Redis flag called llm:kill_switch can be set to pause the spend. This is a cheap incident-response tool that requires only a few lines of code. It's much faster and cheaper than deploying a fix when a spend spike is detected. Additionally, set caps with intent, such as daily caps around 3-5 times the key's observed p99 daily spend and monthly caps around 1.5 times the expected spend.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
