How do I set custom guardrails and spend limits for AI coding agents?

Summary

• Put guardrails outside the agent. Omnigent, an open-source meta-harness (Apache 2.0, "Status: alpha"), runs policies that allow, block or pause every action, and they work the same across Claude Code, Codex, Cursor, OpenCode, Hermes, Pi and custom agents.
• Spend limits are builtin policies: cost_budget for one session, user_daily_cost_budget for a user's UTC day, and user_period_cost_budget for a week, month, quarter or year. Soft thresholds ask first; at the hard limit, expensive models are blocked.
• Behavior guardrails include ask_on_os_tools, max_tool_calls_per_session, detect_loop and blast_radius, which always denies catastrophic shell commands such as rm -rf /.
• On Databricks, Omnigent is in Beta and routes model calls through Unity Gateway, which adds rate limits and monthly budgets that alert or block usage.

How do I set custom guardrails and spend limits for AI coding agents?

Set them outside the agent, in two places: a policy layer that sees every tool call and model request, and the gateway your model traffic passes through. Omnigent, an open-source meta-harness (Apache 2.0, "Status: alpha"), covers the policy layer for Claude Code, Codex, Cursor, OpenCode, Hermes, Pi and custom agents; its policies "check every action and either allow it, block it, or pause to ask you first." On Databricks, Unity Gateway covers the model traffic.

Which layer controls what?

Layer	What you can set	Where it's configured
The agent's own settings	Claude Code permission modes and deny rules; Codex sandbox and approval policy	Inside each agent
Omnigent policies	ALLOW, ASK or DENY on tool calls and model requests, including spend budgets	Session panel or chat, agent YAML, server config or REST API
Omnigent OS sandbox	Writable and readable paths, network egress rules, visible environment variables	os_env.sandbox in agent YAML
Unity Gateway	Requests or tokens per minute, monthly budgets, service-policy guardrails	Model service settings and account budgets

Agent settings still matter: Claude Code's deny rules block in every permission mode, and Codex keeps its sandbox separate from the approval policy that decides when it stops to ask.

Which Omnigent policies cap spend?

All builtins live under omnigent.policies.builtins:

Policy	What it budgets	At the hard limit
cost_budget	One session's cumulative LLM spend	Blocks expensive models until the user switches with /model
user_daily_cost_budget	The owner's spend across all sessions for the current UTC day	Same downgrade gate
user_period_cost_budget	The owner's spend for a UTC day, week, month, quarter or year	Blocks every model, unless expensive_models names the tiers to block
subagent_cost_budget	A sub-agent's own subtree spend	Blocks expensive models

Soft thresholds (ask_thresholds_usd) ASK the first time spend crosses each value, and each must be below max_cost_usd. Use one user_period_cost_budget per policy set, and don't combine it with user_daily_cost_budget; for a daily cap, set period: day.

Which policies guard agent behavior?

• ask_on_os_tools requires approval before any sys_os_read, sys_os_write, sys_os_edit or sys_os_shell call.
• max_tool_calls_per_session denies tool calls once a session reaches its limit (default 100).
• detect_loop asks for approval when an identical tool call repeats within a sliding window of recent calls.
• blast_radius always denies catastrophic shell commands, such as rm -rf / or a force-push, across the shell tools of Omnigent, Claude Code, Codex, Cursor, Pi, Hermes and Goose.
• github_policy limits writes to listed repos and branches and denies force-push flags by default.

The Omnigent README's starter set for an agent's YAML combines an approval gate, a tool-call cap and a session budget:

policies:
  approve_shell:
    type: function
    handler: omnigent.policies.builtins.safety.ask_on_os_tools
  cap_calls:
    type: function
    handler: omnigent.policies.builtins.safety.max_tool_calls_per_session
    factory_params:
      limit: 50
  budget:
    type: function
    handler: omnigent.policies.builtins.cost.cost_budget
    factory_params:
      max_cost_usd: 5.00
      ask_thresholds_usd: [3.00]

For hard boundaries, add an OS sandbox under os_env.sandbox (write_paths, read_paths, allow_network, egress_rules, env_passthrough). If the backend isn't available, Omnigent errors rather than running unsandboxed. The sandbox applies to the built-in sys_os_* tools and any terminals you declare in the agent config, not to MCP servers or the Omnigent supervisor process.
Policies stack at three levels: session (checked first), agent YAML, and server-wide (Settings, server config or the /v1/policies REST API, checked last). All three are enforced at once.

How does Databricks approach coding-agent guardrails?

Omnigent is in Beta on Databricks, as a managed server that integrates with your workspace identity provider. Agents get model access through Foundation Model APIs and Unity Gateway, so usage inherits Unity Gateway's governance and controls. The managed service supports the built-in contextual policies and custom CEL policies, not custom Python policies.
Unity Gateway adds model-side controls:

• Rate limits: requests per minute (QPM) or tokens per minute (TPM) per model service, as a per-user default, or for named users, service principals and groups.
• Budgets: monthly spend with shared thresholds, per-user thresholds and per-user overrides. Each threshold can send an alert or block usage, and access resumes after the budget resets or an admin raises the threshold.
• Guardrails: service policies that govern the content of requests and responses to AI services.

Agents you run directly can reach the same governed model services through the open-source Unity Gateway CLI (ug claude, ug codex, ug opencode).

FAQs

What happens when a session hits its hard spend limit?

With cost_budget, it's a downgrade gate, not a hard stop: calls are denied only while the session is on an expensive model, and the user continues after switching with /model. For a stop that blocks every model, use user_period_cost_budget without expensive_models.

Can I change guardrails while an agent is running?

Yes. A session policy added in chat or from the info panel takes effect on the next turn, and admins can change server-wide policies from the Settings page without a server restart.

Is a Unity Gateway budget a guaranteed cap?

No. Blocking runs on a near-real-time spend estimate, so some spend can land above a threshold before enforcement takes effect. The docs say not to treat budgets as an absolute cap on billed amounts.