Cloud/AI Governance/Circuit Breaker
Circuit Breaker
The last line of defense for your budget: a ceiling on requests inside a sliding window that halts agent traffic automatically when exceeded, holds it during a cooldown, and hands the resume decision to you.
Circuit Breaker is the screen you hope never to need and the one you are glad exists. The eight Reports show what happened; this switch promises what can never happen: a runaway agent loop cannot burn your budget, because when request rates cross your ceiling, agent traffic halts itself. The console's own description: "Automatically halts agent traffic when request rates exceed your defined budget ceiling."
Circuit Breaker Tripped
Agent traffic is currently halted. Your budget is protected. Approve resumption when ready.
Auto-resets in 15m 00s
Rate Protection
Automatically halts agent traffic when request rates exceed your defined budget ceiling.
Maximum number of requests allowed within the detection window before the circuit breaker trips.
Sliding time window in minutes used to count requests. Shorter windows detect spikes faster.
Duration in minutes the circuit stays open before auto-resetting. You can also manually resume anytime.
Circuit breaker settings apply globally to all servers on your account.
The mockup opens exactly how your team would meet this screen in an incident: tripped, traffic halted, with the auto-reset countdown running live. Click Approve Resumption to release it and reveal the three sliders that define the policy.
The amber alert: your budget, protected
When the breaker trips, an amber banner appears above everything with the console's exact words: "Agent traffic is currently halted. Your budget is protected. Approve resumption when ready." No ambiguity about what is happening, and none about whose fault it was: the agent crossed the ceiling, the breaker did its job.
If the Cooldown Period is running, the banner counts down live: "Auto-resets in 14m 52s", ticking by the second. And because an automated recovery may not be the decision you want, the banner carries the Approve Resumption button: you can end the halt on your own terms, the moment you are ready.
The three numbers that define "too much"
- Max Requests (100 to 50,000): the "Maximum number of requests allowed within the detection window before the circuit breaker trips."
- Detection Window (1 to 60 minutes): the "Sliding time window in minutes used to count requests. Shorter windows detect spikes faster." Five minutes catches a runaway loop in minutes; a longer window tolerates bursty-but-legitimate traffic.
- Cooldown Period (1 to 60 minutes): the "Duration in minutes the circuit stays open before auto-resetting. You can also manually resume anytime." The trip is not a permanent lock: the system recovers itself on a timer, and you can always approve sooner.
The three work as one sentence: no more than Max Requests inside the Detection Window, or everything halts for the Cooldown Period.
Global by design
One line closes the screen: "Circuit breaker settings apply globally to all servers on your account." A runaway loop does not get to negotiate which connectors it burns; the ceiling protects the whole fleet. Together with Connector Policy (the rules), DLP Protection (the redactions) and FinOps Guard (the savings), this completes the Settings group: the Reports tell you what happened, and these four screens decide what is allowed to happen, ever.