💡 Agentic Activity Circuit Breakers and Org-Wide Rate Limiting Standard

[github-actions[bot]]

Summary

Define and enforce org-wide rate limits, circuit breakers, and resource budgets for autonomous CI agents (dev-lead, compliance-audit, feature-ideation, initiative-driver) to prevent cascading failures, resource exhaustion, and runaway automation. This addresses real bugs already observed in production — 111 issues stuck from dev-lead concurrency group cancellation (#402) and dispatch races (#443) — with a systematic framework rather than per-incident patches.

Market Signal

• OWASP ASI08 (Denial of Service & Resource Exhaustion) explicitly identifies agentic resource exhaustion as a top-10 risk in the OWASP Top 10 for Agentic Applications (2026)
• The org's recently completed PR-limits initiative (Enable GitHub pull request limits to cut automation-PR noise #505) addresses queue depth (how many PRs can be open) but not execution throughput (how fast/often agents can act)
• GitHub's Workflow Execution Protections (public preview June 2026) add actor/event controls but not rate limiting
• The gap between queue-depth limits and execution-rate limits is precisely where cascading failures live

User Signal

Three real production failures demonstrate the need:

Bug	Symptom	Root Cause
#402	111 labeled issues stuck with no PR	dev-lead issue-pickup runs cancelled by concurrency group — no queue/retry
#443	Multi-label issue creation cancels dev-lead dispatch	Race condition in concurrent dispatches — no serialization or backoff
#571	Feature-ideation discussion-triggered run fails at workflow setup	Zero jobs — dispatch bridge has no error budget or retry

These are all symptoms of the same underlying problem: autonomous agents operating without throughput controls, deadline awareness, or graceful degradation.

Technical Opportunity

The org already has the foundational patterns:

• Workflow-level concurrency groups — prevent duplicate runs per branch
• pr-limit-gate.sh — source-side queue-depth admission control
• standards/pr-limits.json — machine-readable config, single source of truth

Extending this pattern to per-agent-type rate limits and circuit breakers can be implemented in the reusable workflow templates without changing the agent logic itself:

Control	Implementation	Example
Max concurrent runs	Workflow concurrency + gate check	dev-lead: max 3 simultaneous
Max runtime per run	timeout-minutes + monitor	feature-ideation: 30 min cap
Cooldown between runs	Timestamp check in gate script	compliance-audit: 5 min minimum gap
Daily execution budget	Counter in artifact/API state	dev-lead: max 50 runs/day
Circuit breaker	Failure count → backoff → disable	3 consecutive failures → 1hr pause

The Actions Data Stream (on GitHub's 2026 roadmap) would provide the telemetry backend for monitoring these limits.

Assessment

Dimension	Score	Rationale
Feasibility	high	Extends existing pr-limit-gate.sh pattern; no new infrastructure required
Impact	high	Directly addresses 3 real production bugs and prevents the class of failures, not just individual instances
Urgency	high	Bugs are actively manifesting; agent fleet is growing with initiative-driver and feature-ideation additions

Adversarial Review

Strongest objection: PR-limits just shipped (#505). Adding more limits risks throttling legitimate automation and slowing development velocity.

Rebuttal: PR-limits is a queue-depth control (how many items in the queue). Rate limiting is a throughput control (how fast the queue is processed). They're complementary, not redundant — a system with a 50-PR queue cap but no execution-rate limit can still have 50 agents race to process that queue simultaneously. The real bugs (#402, #443, #571) prove that execution-level controls are needed. Well-designed circuit breakers don't slow legitimate work — they prevent the runaway scenarios that make ALL work slower (like 111 stuck issues blocking the entire pipeline).

Suggested Next Step

Define per-agent-type limits (max concurrent runs, max runtime, daily budget, cooldown period) in a new standards/agent-rate-limits.json config file and implement them as a reusable shell library in scripts/lib/agent-rate-limit.sh, mirroring the pr-limit-gate.sh pattern.

[don-petry]

Consider token usage/budget as a primary metric for throttling/rate limiting. A Frequent undocumented issue is the depletion of token budgets. Current agents have visibility, consideration or limits related to budget, resulting in failed runs and depleted budgets that fully block work for agents and humans.

Goal: Pause agentic work when the 5 hour budget reaches 90%. Claude as priority.

[don-petry]

📋 Initiative planned by the BMAD Scrum Master (Bob).

Epic #636 — Agentic Activity Circuit Breakers & Org-Wide Rate-Limiting Standard

5 stories created (inert — labelled initiative, NOT initiative:auto):

• [Phase 1] ADR: agent rate-limit & circuit-breaker taxonomy (decision record) #637 (M) — [Phase 1] ADR: agent rate-limit & circuit-breaker taxonomy (decision record)
• [Phase 2] standards/agent-rate-limits.json config + standard doc (single source of truth) #638 (M) — [Phase 2] standards/agent-rate-limits.json config + standard doc (single source of truth)
• [Phase 3] scripts/lib/agent-rate-limit.sh gate + circuit-breaker library (guard-only) #639 (L) — [Phase 3] scripts/lib/agent-rate-limit.sh gate + circuit-breaker library (guard-only)
• [Phase 4] Wire the gate into the PR/agent-dispatch workflows #640 (L) — [Phase 4] Wire the gate into the PR/agent-dispatch workflows
• [Phase 5] Token-budget circuit breaker: pause at the configured % of the 5-hour Claude window #641 (L) — [Phase 5] Token-budget circuit breaker: pause at the configured % of the 5-hour Claude window

Open questions for review:

• The Phase-1 ADR must select a telemetry source for the rolling 5-hour Claude subscription budget; no native GitHub surface exposes it today (the Actions Data Stream is a 2026 roadmap item; the private repo's token-metrics JSONL is per-run, not windowed). Story 5's implementation is contingent on that selection.
• Wiring the rate-limit gate and 5-hour token telemetry into dev-lead and compliance-audit requires a companion change in the private petry-projects/.github-private repo (dev-lead's reusable workflow, engine.sh, and token-metrics all live there). Confirm whether that companion work is tracked under this epic or a separate cross-repo initiative.
• Configured limit values (max concurrent, runtime, cooldown, daily budget, 90% token threshold) require human sign-off before any gate enforces them, mirroring the pr-limits sign-off gate ([Phase 3 gate] Human sign-off: final PR-limit caps + exempt list + rollout scope #566). The Phase-2 config lands inert.

---

Review the epic and its sub-issue DAG, adjust as needed, then add initiative:auto to epic #636 to hand it to initiative-driver for auto-implementation.