Agencies are capping their AI agents' tokens, because a rule in a prompt is only a suggestion

Media agencies running AI agents on live campaigns have started building their own audit logs and spending caps, having found that agentic tools return nothing if they are left alone with a budget. Digiday reported on September 4 that Rise, Dept, Brainlabs and PMG have each wrapped tracking around the agents their staff use: time-stamped decision logs, per-person token allowances, or a central gateway that picks the model for you. Two days later Jason Lemkin, writing at SaaStr about his own build, reached the same conclusion from the opposite direction. The only rules an agent obeys are the ones it cannot reach.

Together they describe a control problem that arrives the first week any marketing agent gets write access to something that costs money.

What the agencies built, and why

The numbers behind the scramble come from Gartner. In an April survey of 1,300 senior marketers cited by Digiday, 56% of companies were rolling out AI tools with no clear usage policy, and marketing leaders were less likely than their peers to attach financial controls to AI use. Gartner expects 60% of organizations using AI to hit cost overruns caused by not tracking usage.

Rise, the performance agency inside the Quad group, has tested media-buying agents with an unnamed supermarket client since June, using an audit-log feature from the ad exchange PubMatic to catch an agent drifting outside its given parameters. Group director Klaudia Smykowska told Digiday the point is reconstructing a decision afterwards rather than taking the agent's word for it. Dept took model choice away from staff entirely, routing prompts centrally on commercial and, for clients with data-residency requirements, legal grounds; it had seen individuals burn through 1.5 million tokens in a day. Brainlabs allocates tokens in tiers, and PMG built a daily per-user cap into a tool it calls Alli For You.

Gartner analyst Nicole Greene's diagnosis, in the same piece, is unglamorous: bills climb because people reach for the most capable model regardless of the job. Nobody quoted has a clean cost figure either: Rise triangulates from licensing, tokens, hours saved and working media, which svp George Forge called "a very rough math equation at this point".

A rule in a prompt is a suggestion

Lemkin's post is a personal account rather than research — a recap of a 20VC episode, on a media business whose founder also runs a venture fund. But the mechanism he describes is the one the agencies are paying to discover. Once you have written eighty or a hundred rules for an agent, he argues, they start contradicting each other and the agent picks a winner. His example: a rule capping spend at $100, a second rule saying the theater matters more than anything, and an agent that buys the $5,000 tickets without any confusion about it.

His own systems assume that outcome: SaaStr runs Salesforce headless, the agents on top do strange things most weeks, and the data survives because it is locked at the permissions layer, out of the agent's reach. His advice is to locate the place where a limit is genuinely enforced.

"If it lives in the prompt, you have a suggestion. Move it to a card limit, a scoped API key, or a read-only role."

The rest of his argument is about verification: trust the provider's log or the live state, not the summary the agent hands you. That is the instinct PubMatic sold to Rise — a system that can be wrong about a campaign can be wrong about its own history.

What a software marketing team should change

It would be easy to file this under agency problems, but the agents going into software marketing stacks now touch ad accounts, CRM records, an email platform, a CMS and a support inbox. A hallucinated paragraph is embarrassing. A send, a spend or an overwritten field is not fixed by editing.

The two remedies on offer also do different jobs, and neither substitutes for the other. A token cap controls what AI costs you and says nothing about whether the agent did the right thing. An audit log tells you what happened, but only after it has happened. Neither stops an action. Only permissions do, which makes the least fashionable item on the list the one worth doing first.

• Move every hard limit out of the prompt: a budget cap in the ad platform, an API key that can draft in your ESP but not send, publish rights off in the CMS, field-level permissions on the CRM objects an agent touches.
• Keep an independent log. If your only record of what an agent did is the agent's account of it, you have no record.
• Put a name on every deliverable. Dept's Jonathan Whiteside told Digiday that "every deliverable has an accountable human", which costs nothing and settles the question before it is asked.
• Work out token spend per workflow before an efficiency number goes in a board deck. If four large agencies are still triangulating, so are you.
• Choose the model per job, not per habit. The cheapest saving available is not running a weekly report through your most expensive model.