The limit belongs to the business issue, not to each API call or each agent. Define a stable budget scope such as tenant, customer, case, currency, and policy period. Different tool names that issue the same economic effect must draw from that same scope. Otherwise the agent can get around a cap by changing the call shape, recipient, or worker. The model can propose a sequence, but it cannot create a fresh budget namespace by deciding that each child is a new case.

Before issuing an effect, the broker reserves its maximum amount against a durable aggregate ledger. Reservation and balance check must be one atomic operation under a concurrency control that prevents two children reading the same available $100. A serializable transaction with retry on a serialization failure is one implementation, or a conditional update on a single budget row if contention and storage semantics fit. PostgreSQL's transaction isolation documentation describes why serializable work may need retries. The retry is for the local reservation transaction, not a blind retry of an already sent credit. Once reserved, attach the operation ID and policy version to the provider request and record the provider's result.

Budget reservation before an external credit effect
The shared ledger serializes the budget decision. A timed out provider call retains its reservation until its outcome is reconciled.

The five children now race for one balance. Four $25 reservations can succeed. The fifth is rejected or paused for a higher approval. But the question's timeout changes accounting: if the provider might have accepted a call, I keep its reservation in an unknown state. Releasing it on timeout allows a replacement credit and can overspend. Reconcile by operation ID, provider idempotency key, or provider records. On confirmed failure release the reservation. On confirmed success settle it. If the provider cannot answer yet, hold the amount and surface the uncertainty. A manual override should be a new, explicit authorization that accounts for the outstanding unknown amount.

Why not a token bucket or rate limiter? It controls pace, not the total economic obligation, and it may reset while effects remain unsettled. The ledger also needs a clear policy for refunds or reversals: a compensating debit does not erase the historical credit, and the business owner must decide whether it replenishes the cap. Test two parallel children, two different credit tools, duplicate messages, a crash after reservation, timeout after provider commit, and a new worker resuming the same operation. The invariant is simple to say and hard to implement: settled plus reserved plus unresolved exposure cannot exceed the authorized aggregate cap without a recorded exception.