Autonomous AI agents can now decide at runtime which models to call, how often to retry, which paid tools to use and how long to keep working. Microsoft engineers Tisha Chawla and Susheem Koul have built and presented TokenOps, an open-source reference architecture for real-time, run-scoped cost control that places the budget inside the execution loop while the agent is still running. The larger story, however, extends beyond TokenOps: Cloudflare, Portkey, Microsoft, OpenTelemetry, Langfuse, OWASP and the Linux Foundation are independently addressing different parts of the same emerging problem, and the industry is assembling something that resembles an economic control plane for autonomous software.
What Is TokenOps?
TokenOps is an open-source reference architecture for real-time, run-scoped cost control of autonomous AI agents, developed and publicly presented by Microsoft engineers Tisha Chawla and Susheem Koul. Its existence is corroborated through multiple public records identified during POPR verification: the Microsoft Command Line publication dated August 13, 2026, the AI Engineer World's Fair 2026 conference listing for "FinOps for AI Agents: Who Spent All the Tokens?" and the public theagentplane/tokenops GitHub repository.
That provenance matters because TokenOps should be understood precisely. It is not an announced Azure managed service, nor a Microsoft Foundry SKU, and it should not be confused with Microsoft's separate production governance capabilities: agent token caps and usage quotas within the Cloud Adoption Framework, and real-time agent-run spend monitoring within the Foundry Control Plane. TokenOps is a reference architecture aimed at a more specific problem — controlling the cumulative economics of a live autonomous run before the system makes its next costly decision. That distinction places the budget inside the execution loop rather than leaving it solely in an accounting report produced after the work has already occurred.
Why Is the AI Agent Run Becoming an Economic Unit?
Traditional API accounting naturally focuses on individual requests. An agent, however, can turn one human request into many machine actions. A user may ask an agent to perform one task, but fulfilling that task can require repeated model calls, tool calls, retries, handoffs and decisions distributed across several processes or agents. If each component sees only its own spending, the organization can lose visibility into the economics of the complete task. TokenOps addresses this by treating the run as a shared economic object — one of the architecture's most consequential ideas.
Instead of asking only how much a single API call cost, the infrastructure can ask how much the entire run has spent so far. Those questions sound similar; architecturally they are very different. A single autonomous task may cross model, process, agent and tool boundaries. Governing each call independently does not necessarily govern the aggregate economic behavior of the task that produced those calls.
The Shared-Ledger Problem
The TokenOps project describes a failure mode that illustrates the underlying architecture problem. According to the project's own reported implementation experience, independent processes maintained separate spending counters rather than operating from one authoritative shared ledger. Under concurrent execution, each process could therefore behave as though budget remained available. The practical effect was that usable spending capacity could effectively be duplicated.
TokenOps' response is a shared multi-agent run ledger that gives all participating components a common economic state rather than allowing each to reason from an isolated local view of the budget. The specific bug and its resolution remain author-reported TokenOps primary-project material; POPR's verification confirmed that the architecture and account are genuine but did not independently reproduce the experiment. The significance of the example is architectural rather than promotional: once several autonomous processes can spend against the same resource envelope, budget state itself becomes shared system state.
What Are STEER and HALT?
TokenOps distinguishes between two forms of enforcement intervention: STEER and HALT. HALT is the more straightforward concept — the system reaches a policy boundary and further execution stops. STEER is more interesting because economic governance does not need to be binary. Instead of allowing an agent to continue unchanged until a hard budget is exhausted, an enforcement layer can alter the agent's behavior before that point. That introduces a broader design principle for autonomous systems: a resource constraint can become part of the runtime decision architecture, influencing how an agent pursues a task rather than merely deciding whether it is allowed to continue pursuing it at all.
Why Deterministic Enforcement Matters
TokenOps uses deterministic, non-LLM-based policy enforcement, and that architectural separation is important. An AI model can participate in deciding how to accomplish a task, but the system does not need to ask the same probabilistic model whether it has permission to exceed the economic boundary governing that task. The distinction is between intelligence and authority: a model may propose another action, and a deterministic policy layer decides whether that action is permitted within the resource envelope. This architecture reflects a broader principle already familiar in computing — uncertain or probabilistic execution operating inside deterministic boundaries. For autonomous agents, those boundaries increasingly include money.
TokenOps Did Not Invent Real-Time AI Budget Enforcement
This is where the competitive landscape becomes important. TokenOps is a significant implementation of run-scoped agent economics, but the sealed POPR research specifically rejects presenting it as the invention of runtime AI cost governance.
Cloudflare AI Gateway already provides cumulative dollar-spend limits scoped by model, provider or custom metadata; once a limit is reached, the gateway can block additional calls or route traffic toward a fallback model. Portkey independently provides active token and cost-budget enforcement across provider, API-key and workspace scopes, blocking additional usage once configured limits are reached. These are not merely dashboards reporting what happened yesterday — they are enforcement mechanisms operating in-path. The narrower architectural distinction that survives the POPR hostile audit is that no product identified in the sealed research exposes TokenOps' exact combination of a shared multi-agent run ledger, its specific lineage representation and its STEER/HALT policy architecture. Even that claim requires caution: Cloudflare allows spending limits to be scoped using arbitrary custom metadata, so a system could attach a common run identifier to calls belonging to a single execution and plausibly approximate run-scoped budgeting.
The Hard Distributed-Systems Problem Behind an AI Budget
There is a deceptively difficult engineering question underneath all of this: when exactly does the system know the money has been spent? Cloudflare's own AI Gateway documentation states that its spend limits are eventually consistent — the cost of the current request is recorded after completion, and bursts of concurrent requests can temporarily push actual spending above a configured threshold before enforcement catches up.
That limitation independently reinforces a tradeoff also discussed in TokenOps. Strict budget precision and distributed-system performance can pull in opposite directions. When several agent processes simultaneously check a budget, each sees remaining capacity and each initiates another model call. Only after those calls finish are their costs recorded, so the budget can be exceeded even though every participant checked the limit before acting. The alternative is stronger coordination around a shared economic state, but stronger coordination can introduce latency, contention and infrastructure complexity. Cloudflare independently documenting the same consistency problem confirms that economic consistency is a genuine systems-engineering issue for agent infrastructure, not merely a TokenOps implementation detail.
Observability Is Becoming Part of the Economic Stack
The surrounding telemetry ecosystem reveals another part of the transition. OpenTelemetry's generative-AI semantic conventions include agent identity, workflow names, token usage and tool execution. Langfuse provides cost and usage tracking across sessions, users and models. These systems establish that detailed attribution of AI execution existed as a concept before TokenOps introduced its own token-lineage terminology.
They also complicate any simple division between observability and enforcement. An observability system does not need to be the component that blocks an action in order to participate in governance. Langfuse explicitly notes that its metrics can feed downstream billing or rate-limiting systems. That suggests a layered architecture in which one system establishes what happened, another establishes what it cost, another evaluates the policy and another determines whether the next action is permitted. As autonomous systems become more complex, those functions increasingly resemble components of an economic operating layer rather than isolated monitoring features.
Why Agent Costs Are Also a Security Problem
There is another reason this cannot be treated solely as accounting. OWASP's LLM10:2025 Unbounded Consumption category recognizes runaway resource use and denial-of-wallet scenarios as security risks — not merely FinOps concerns. A spending boundary is therefore not only a finance control; it can also be a security boundary. If an attacker, malformed workflow, recursive process or badly governed agent can cause a system to continue consuming paid resources, the economic consequence becomes part of the attack surface. The question shifts from whether infrastructure spending is efficient to whether the system can be induced to spend resources it was never supposed to spend. The same ledger can therefore serve finance, governance and security purposes simultaneously.
Why "Token Governance" Is Already Too Narrow
Tokens are the most visible unit because model providers commonly meter inference through them, but an autonomous agent can consume more than tokens. The Linux Foundation announced its intent to launch the Tokenomics Foundation on June 3, 2026, in coordination with the FinOps Foundation and with support from major AI buyers, cloud and model providers and infrastructure companies. Its stated framing independently supports a broader concept than token budgeting alone: tokens represent only part of total AI expenditure, and organizations need ways to understand economics across models, vendors, infrastructure and business value.
POPR classifies that broader category as Agent Resource Governance. The term is POPR synthesis, not an externally established industry standard, and its purpose is to describe the wider resource problem accurately. An autonomous system can consume inference, tools, storage, retrieval, compute and other metered resources in a single task. Governing only token count can therefore miss a material portion of the agent's actual economic behavior.
The Real Change: Software Is Making More of the Spending Decisions
This distinction deserves precision because it is easy to overstate. Autonomous agents did not invent runaway software costs. Cloud infrastructure has always needed quotas, limits, budgets and resource governance, and cloud autoscaling, serverless computing, metered APIs and batch workloads have always created variable and sometimes runaway expenses. The more defensible shift is subtler. Agents increasingly decide at runtime how resources should be allocated inside the task itself. A traditional application executes a predefined sequence of operations whose cost varies with workload. An autonomous system can decide that the first approach failed, select another model, call another tool, retain additional context, retry an operation, involve another agent and continue searching for a solution — and each of those decisions is made by the running software, not specified in advance. The resource-allocation decision is becoming part of the software's reasoning loop, and that is a materially different governance problem than managing a predictable workload.
A Resource Envelope May Become as Important as a Permission Boundary
Organizations already understand the principle of least privilege: a user or service should receive only the permissions necessary to perform its job. Autonomous agents suggest a parallel principle. An agent may need not only a permission envelope but also a resource envelope. Permission answers what the agent may do; resource governance answers how much it may consume while doing it. Those controls are related but not interchangeable. An agent can be fully authorized to use a model, database or external tool and still consume those resources irresponsibly. Conversely, an agent can remain under budget while attempting something it should never have been authorized to do. A mature autonomous architecture has to govern both authority and consumption.
The POPR Agent Resource Control Plane
The sealed research supports a broader POPR synthesis for how these components may eventually fit together: Identity to Permissions to Resource Envelope to Run Identity to Execution to Live Ledger to Deterministic Policy to STEER/HALT/Human Escalation to Provenance to Outcome Verification to Audit. This is not an external standard. It is a POPR analytical architecture assembled from components that already exist across the emerging agent ecosystem, and it is labeled as such.
Identity establishes which actor is operating. Permissions establish what that actor may access. The resource envelope establishes how much it may consume. Run identity connects the economic activity belonging to one execution. The live ledger records consumption as the run develops. Deterministic policy evaluates the resource state. STEER, HALT or human escalation determines what happens when policy boundaries are approached or crossed. Provenance records what occurred. Outcome verification asks whether the work actually succeeded. Audit preserves the record needed to understand the system afterward. Taken together, these components suggest something larger than another AI billing dashboard: an economic control plane for autonomous execution.
The Most Important Problem Is Not Cost
The deepest limitation of agent budgeting appears once the budget system works perfectly. An agent receives a resource envelope, spends within it, every transaction is attributed correctly, the ledger is accurate, no policy is violated and no concurrent process overspends. The system performs exactly as designed. And the answer is useless. Economically, the agent remained compliant. Operationally, it failed. That distinction may become more important than any individual budget technology.
TokenOps reports a 78.9% cost reduction and within-cap completion ranging from 67% to 96% across a 27-run benchmark. Those figures are author-reported primary-project results and have not been independently replicated. More importantly, Microsoft explicitly distinguishes completion from correctness in its own documentation. Finishing within budget is not the same as producing a correct result, and that caveat changes how the benchmark should be interpreted.
The Next Metric Is Cost Relative to Outcome
Raw spending measures resource consumption; it does not measure value. A $0.50 run that produces the wrong answer may be economically worse than a $5 run that reliably completes a high-value task. A system optimized only for minimum token consumption can therefore become cheap without becoming useful. The more meaningful objective is not lowest cost per run but something closer to lowest justified resource cost for an acceptable verified outcome. The exact metric will depend on the task, but the direction is already visible in the infrastructure: OpenTelemetry separates execution telemetry from evaluation concepts, while the Tokenomics Foundation's framing explicitly extends beyond raw cost toward efficiency and business value. The agent economy needs to know not only what was spent — it needs to know what the spending accomplished.
Why This Matters for Multi-Agent Systems
The problem becomes more pronounced when several agents collaborate. A single agent can already generate multiple calls. A multi-agent system can create a hierarchy of delegated work in which one process initiates another, which invokes a model, which calls a tool, which returns information that triggers another round of reasoning. At that point, individual API-call accounting becomes an incomplete representation of economic behavior. The system needs lineage: which task initiated the spending, which agent made the decision, which model was used, which tool consumed resources, which retry increased the total and which branch of the workflow should have been terminated. A shared run ledger makes those questions easier to ask because it preserves the relationship between spending and the execution that produced it. This is where agent economics begins to resemble governance rather than bookkeeping.
The Industry Is Building Different Pieces of the Same Layer
No single product in the sealed evidence represents the entire emerging stack, and none should be treated as the final architecture. TokenOps emphasizes run-scoped shared-ledger governance and deterministic STEER/HALT enforcement. Cloudflare AI Gateway demonstrates real-time gateway-level spend limits, dynamic fallback behavior and the practical eventual-consistency problem that any distributed enforcement system faces. Portkey demonstrates active cost and token enforcement across infrastructure scopes. OpenTelemetry provides standardized concepts for observing models, agents, workflows, tokens and tools. Langfuse provides detailed cost and usage attribution that can feed downstream billing or limiting systems. Microsoft's production governance infrastructure separately provides token caps, quotas and agent-run spend monitoring. OWASP establishes that uncontrolled consumption can become a security problem. The FinOps Foundation's FOCUS 1.2 supports virtual-currency pricing constructs. And the Linux Foundation's Tokenomics Foundation initiative is explicitly aimed at developing standards, benchmarks and best practices around AI infrastructure economics. These projects are not interchangeable, but together they expose the contours of the same infrastructure problem: autonomous intelligence requires economic boundaries.
The Question After "Can the Agent Do It?"
For much of the current AI cycle, the defining question has been capability: whether the model can reason, use tools, write code, browse, collaborate with other agents and finish a complex task autonomously. Those questions remain important. But once autonomous execution becomes technically possible, a second class of questions becomes unavoidable. How much authority should the agent have? How much can it spend? Who shares the budget? What happens when it approaches the limit? Who can override the limit? Can every resource decision be reconstructed afterward? And did the final outcome justify the resources consumed? That is the transition from agent capability to agent economics, and the infrastructure being built around TokenOps, Cloudflare, Portkey, OpenTelemetry, Langfuse, Microsoft's governance systems, OWASP and the emerging Tokenomics Foundation suggests that transition is already underway.
The future autonomous system may not simply receive a prompt and a set of permissions. It may receive a resource envelope, a run identity, a ledger and an economic constitution. And the ultimate test will not be whether it stayed under budget. It will be whether the resources it was trusted to spend produced something worth paying for.
Fact Summary
What is TokenOps? TokenOps is an open-source reference architecture developed and publicly presented by Microsoft engineers Tisha Chawla and Susheem Koul for real-time, run-scoped cost control of autonomous AI agents.
Is TokenOps a Microsoft Azure or Foundry product? No. The sealed evidence identifies it as a reference architecture, not an announced Azure managed service or Microsoft Foundry SKU. Microsoft separately operates production governance capabilities involving token caps, quotas and agent-run spend monitoring.
Did TokenOps invent real-time AI spending enforcement? No. Cloudflare AI Gateway and Portkey independently provide active spending or usage enforcement. TokenOps represents a specific architecture within a broader industry movement.
What makes TokenOps architecturally distinctive in the verified research? Its explicit combination of a shared multi-agent run ledger, lineage representation and STEER/HALT policy architecture. The evidence does not establish that no competing architecture could approximate run-level controls.
What is a shared run ledger? A common economic state for all processes participating in an agent run, allowing cumulative spending to be governed across the full execution rather than through isolated local counters.
What is the difference between STEER and HALT? HALT stops execution when policy requires termination. STEER allows the system to modify behavior in response to resource constraints rather than immediately terminating the run.
Why is deterministic enforcement important? It allows hard resource policies to remain outside probabilistic model judgment. The AI decides how to pursue the task; a deterministic control layer decides whether the proposed resource consumption is permitted.
Can AI systems exceed a configured budget even when enforcement exists? Yes, under some architectures. Cloudflare explicitly documents eventual consistency in its spend-limit system, meaning concurrent requests can temporarily exceed a configured limit before updated spending is reflected.
Is agent cost governance entirely new? No. Variable software costs and resource governance predate agentic AI. The newer problem is that agents increasingly make their own resource-allocation decisions during a live task.
Why is runaway agent spending a security issue? OWASP's LLM10:2025 Unbounded Consumption category recognizes denial-of-wallet and runaway resource exhaustion as security risks, placing resource controls at the intersection of FinOps and security.
Are tokens the complete measure of agent cost? No. The sealed research supports a broader Agent Resource Governance framing because autonomous agents can consume resources beyond model tokens.
Does staying under budget mean an agent succeeded? No. TokenOps itself distinguishes completion from correctness. A run can remain within its resource limit and still produce a worthless or incorrect outcome.
What is the larger economic problem? Agent infrastructure ultimately has to connect resource consumption to verified outcomes. Cost governance without outcome verification can establish that money was controlled without establishing that the money created value.
Evidence Status
CONFIRMED: TokenOps is a real open-source reference architecture publicly presented by Microsoft engineers Tisha Chawla and Susheem Koul.
CONFIRMED: TokenOps is not an announced Azure managed service or Microsoft Foundry SKU.
CONFIRMED: Cloudflare AI Gateway provides in-path cumulative spend enforcement and explicitly documents eventual-consistency limitations during concurrent requests.
CONFIRMED: Portkey provides active cost and token-budget enforcement.
CONFIRMED: OpenTelemetry and Langfuse demonstrate that agent, workflow, token and cost attribution concepts predate TokenOps' lineage terminology.
CONFIRMED: OWASP recognizes unbounded LLM resource consumption and denial-of-wallet as a security concern under LLM10:2025.
CONFIRMED: The Linux Foundation announced its intent to launch the Tokenomics Foundation on June 3, 2026, with a stated focus on AI infrastructure economics, standards, benchmarks and best practices.
AUTHOR-REPORTED: TokenOps reports a 78.9% cost reduction and 67% to 96% within-cap completion across a 27-run benchmark. These results have not been independently replicated, and completion does not establish correctness.
POPR SYNTHESIS: Agent Resource Governance is the broader category proposed for governing the multiple resources autonomous agents can consume. It is not an externally established industry standard.
POPR SYNTHESIS: Identity to Permissions to Resource Envelope to Run Identity to Execution to Live Ledger to Deterministic Policy to STEER/HALT/Human Escalation to Provenance to Outcome Verification to Audit represents a candidate agent-resource control-plane architecture assembled from independently real components.
NOT ESTABLISHED: That TokenOps invented runtime AI cost governance; that conventional software never required economic resource controls; that TokenOps is categorically unique among all competing products; that staying within an agent budget establishes correctness or value; or that one current vendor architecture represents the final industry standard.
Sources
- Microsoft Command Line. Tisha Chawla and Susheem Koul. "Who spent all the tokens? Real-time, run-scoped cost control for AI agents." August 13, 2026.
- AI Engineer World's Fair 2026. "FinOps for AI Agents: Who Spent All the Tokens?" Conference listing for Chawla and Koul.
- GitHub. theagentplane/tokenops. Public TokenOps repository.
- Microsoft Cloud Adoption Framework. Agent cost governance, token caps and usage quotas.
- Microsoft Foundry Control Plane. Real-time agent-run spend monitoring documentation.
- Cloudflare AI Gateway. Spend Limits documentation, including eventual-consistency behavior under concurrent requests.
- Cloudflare AI Gateway. Dynamic Routing documentation, including budget-limit fallback behavior.
- Portkey. Budget Limits, Workspace Budget Limits and Usage Limit Policies documentation.
- OpenTelemetry. Generative AI semantic conventions for model operations, tokens, agents and tool execution.
- Langfuse. Token and Cost Tracking and Sessions documentation.
- FinOps Foundation. FOCUS Specification 1.2, including virtual-currency and AI pricing constructs.
- OWASP. LLM10:2025, Unbounded Consumption.
- Linux Foundation. Tokenomics Foundation intent-to-launch announcement, June 3, 2026.
- Debenedetti et al. CaMeL research, 2025. Used only as a structural analogy concerning deterministic control around nondeterministic model execution.