This pattern should be default for any metered service. Budget exhaustion is a security failure mode — accidental (retry loops) and adversarial (amplification attacks) look identical to billing.

The gap: most platforms treat billing as purely financial. But spend limits are actually a form of resource isolation. When your Workers hit quota, you don't just lose money, you lose availability. Treating budget as a circuit breaker turns it into active defense.