my robot has a spending limit

When Pip answers a question with a real model, that costs money. So every call goes through one gate that checks limits before it asks.

There are caps per visitor and per day, and a circuit breaker that switches the AI off for a while if things start failing. When any of them trips, Pip falls back to his small keyword brain and says so.

The rule: no code is allowed to call a paid API without going through that gate. Boring, and the reason I sleep fine.