Spending limits belong outside the agent

Limits expressed in the prompt are suggestions. Limits enforced by the credential — capped, scoped, expiring — are limits.

Every incident we reviewed involved the first kind, and in most of them the model produced a coherent justification for exceeding it.