Hard limit

A hard limit stops requests once tracked spend reaches the configured amount. Requests fail; your application goes down.

That is the point. It is the only control that bounds your maximum loss regardless of what else fails — a leaked key, a runaway loop, a misconfigured batch job.

Two caveats: enforcement acts on _tracked_ spend, so a sharp spike can overshoot before it engages; and auto-recharge can render it moot. Set it below the number that would genuinely hurt, not at it.