Your budget is a smoke alarm, not a sprinkler

You set a budget of $500. You get an email at 80%. You get another at 100%. If things are going badly you get one at 200%, and then at 400%.

The machines never stop.

The budget did its job perfectly. Its job was to tell you.

A budget is an observer

Read the documentation closely and you will notice how carefully it is worded. Alerts. Thresholds. Notifications. Forecasts. Nowhere in there is the word stop.

A cloud budget is a monitoring product wearing a finance product’s name. It watches a number go up and it tells you about it. If you happen to be asleep, it tells your inbox.

This is not an oversight, and it is not really malice either. It falls directly out of postpaid billing. You consume first and pay later, which means that at the moment of consumption there is nothing to decline — the money is not in the system yet. There is no balance to run out. The meter simply runs, and the invoice arrives afterwards to describe what happened.

And every incentive in that arrangement points away from a hard stop. A provider that halts your production workload to save you money gets to explain an outage to an angry customer. A provider that lets it run gets to explain an invoice — to a customer who, by then, already owes the money.

Given those two conversations, you can predict which product got built.

Nobody decides to spend $70,000

Runaway spend is never a decision. It is always a loop.

• A retry storm with no backoff, hammering a metered API a few thousand times a second.
• An autoscaler whose ceiling somebody set to a number that felt “high enough to be safe”.
• A key committed to a public repository on Friday, and somebody else’s mining operation running on your account by Saturday.
• A batch job that was only ever supposed to run once.

Each of these is trivially cheap per second. That is exactly why nothing catches them. The threshold gets crossed somewhere around minute four, an alert lands in an inbox at 3am on a Saturday, and the meter keeps running for another forty hours while the person who could have stopped it sleeps through the notification that was supposed to save them.

The alert was not wrong. It was just never load-bearing.

What an actual cap looks like

A spending limit that genuinely limits spending has to be structural, not advisory. It cannot be a threshold that triggers a message; it has to be a wall the meter runs into and cannot dig through.

There is really only one honest version of that:

You cannot spend money you have not already handed over.

Prepaid. The balance is the ceiling. Not a number you typed into a form that generates emails — a floor under the meter.

What we do instead

Two things, and we will be straight about which is which.

We have budgets. They send email. They are a smoke alarm, exactly like everybody else’s, and we are not going to stand here on a blog that keeps telling you to read the fine print and pretend that ours are magic.

The sprinkler is the balance. Kaligon is prepaid: you top up, and per-second usage draws down against what is actually there. As it gets low, we warn you. When it runs out, your machines are suspended — not silently deleted — and you get a grace period to top up before anything is destroyed. Suspended is recoverable in a click. A $70,000 invoice is not recoverable at all.

So your worst case is bounded by a number you already chose, in advance, by moving money — rather than by a threshold you configured and an email you slept through.

The honest caveat, because we would rather you heard it from us: the enforcement sweep runs continuously but not infinitely fast, so in a genuine runaway a balance can dip slightly past zero in the seconds before the suspension lands. It is bounded and it is small. It is not the four-figure surprise that postpaid billing can hand you, and it is not a number you will need to negotiate with anyone about.

That is the whole trick, and it is not really a trick. It is just refusing to bill you for money you never gave us.

Keep your alerts. They are genuinely useful.

But if your spending limit requires you to wake up and personally intervene, it is not a limit.

It is a notification with very good marketing.