What happens when a budget is exceeded?

A ceiling that halts service protects the budget and damages trust; one that logs an overage and continues protects the user and abandons the control. Neither extreme is satisfactory, which is why the interesting design is the middle.

Because Centralpoint holds governed answers in the local index, an approaching ceiling can be met by serving previously approved responses rather than by refusing to answer — the service stays available while marginal cost goes to zero. SkillTokenBudget bounds individual executions beneath that, so a single runaway request cannot consume an allocation intended for a department.