Your agents have a budget.
They don't have a brief.

The problem

You can answer what you spent. You can't answer what for.

Finance asks what the agents cost last quarter. You have that number. Then they ask what you got for it — and every honest answer starts with "we don't really track that."

• Which of your agents needed the expensive model, and which just got it?

  Your priciest model spends its day reading files, running greps and polling CI — work a cheaper one does identically. Nobody decided that; it's the default, and every subagent that spawns inherits it, eleven at a time, in forty minutes. On the invoice it all looks the same.

• Your only dial has two settings.

  Every quarter someone asks you to widen what the agents can reach — production, the secrets manager, the cloud console. Each request makes them more useful and the blast radius bigger.

• When you cut budgets 20%, which 20% of the work stopped?

  Your budgets are set per head, because headcount is the only dimension you have.

• You've asked twice. What's your next move — ask a third time?

  There's still an engineer running your most expensive model to explore the codebase.

You're governing the largest new line item in your engineering budget with the bluntest instrument you own.

Why your stack can't close it

Four systems. Same blind spot.

The gap is identical in all four cases: nothing records what an agent session was for.

How it works

Declare the scope. Enforce it at the tool call.

Nobody types a scope. Remit resolves it from the first prompt the developer already wrote — "pick up ticket #35" becomes a statement of the work — and from the spawn payload for every subagent underneath. Every tool call is then checked against it before it runs: on-task work passes silently, off-task work is blocked with a reason the agent can act on. The scope lives outside the agent, so the agent can't rewrite it.

Remit is a small local agent that runs wherever your agents run, plus one control plane for the fleet.

Policy

One set of rules. Two budget lines.

Plain sentences in a file in your repo. No DSL, no policy syntax, nothing to learn — the classifier reads English, so a rule is just the thing you'd say to a new starter. Versioned and reviewed like the rest of your code.

## Policy

- Test agents don't write to the source directory.
- Exploration work doesn't run on the top-tier model.
- Nothing leaves the repo without an explicit ask.

The first is a security rule. The second is a cost rule. The third is both. Remit doesn't need to know which is which — same sentence, same enforcement point, same check.

Which is the commercial point: the security budget and the cost budget pay for the same install.

Access

The access problem you can't dial

Agents get more useful the more you give them. The repository. The ticket system. The cloud console. The secrets manager. Every one of those is also the blast radius — so you're choosing between a useful agent and a safe one, and both answers are wrong.

Remit doesn't shrink the grant. It narrows the moment. Standing access, situational use — the agent can still reach production, just not while it's writing documentation.

What you get

A gate, not a dashboard

For your platform team

Two questions they'll ask first

Pricing

Audit it before you install it