A circuit breaker for AI and messaging spend
2026-07-09 · Vorluno
In a multi-tenant product where the platform pays for AI calls and outbound messages, one runaway tenant — a loop, a blast, an abuse case — can spend thousands of dollars against a $250/month plan. And with most payment rails, that money is gone before anyone notices. Niiko's answer is a circuit breaker: not billing, not a quota — an emergency brake.
The design rule that matters: spend is never a counter you increment. Counters drift — a retried job double-counts, a crashed worker under-counts, and slowly the number on the dashboard stops matching the detail. Instead, every AI call and every message lands as a usage row, and the breaker recomputes the period's spend as a SUM over those projections each time it evaluates. The number can always be audited against its own detail, because it is derived from it.
The breaker's verdict, though, does get persisted — in its own latch table, one row per tenant: tripped or active, why, and when. That's deliberate asymmetry. Measurement is recomputed because correctness matters more than speed; the state is latched because the hot path (should this message send right now?) must be answered cheaply, without re-summing a month of usage per message, and because an alert should fire once, not on every evaluation.
Two more decisions did the heavy lifting. Fail-closed: if the evaluation itself errors, the system behaves as if the breaker had tripped — a paused tenant is a support ticket, an unmetered one is an invoice you already paid. And payer-awareness: when a tenant connects their own WhatsApp number, Meta bills them directly, so those rows carry payer="tenant" and are excluded from the platform's own spend — otherwise the breaker would trip on money we never spent.
None of this is exotic. It's the same discipline as double-entry bookkeeping applied to operational spend: derive, don't mutate; persist decisions, not running totals; and when in doubt, stop the machine. The breaker has one job — make the worst night the platform can have cost hundreds, not thousands — and it earns its keep by construction, not by vigilance.