GVNR
Spend caps are no longer unique and it would be dishonest to imply otherwise. Anthropic ships usage-credit limits at organization, group and member level, workspace spend limits on the Console, and a self-hosted gateway with per-user caps that block requests. Third-party tools cap Claude Code spend per session, day, week and month.
What none of them do is decide whether an action is allowed at all.
| Sees spend | Stops spend | Gates the action | Names who it acted for | Tamper-evident | |
|---|---|---|---|---|---|
| Provider dashboards | after the fact | no | no | no | no |
| Observability tools (Helicone, Langfuse, ccusage) | yes | no | no | no | logs, editable |
| LLM gateways (LiteLLM, Portkey) | yes | hard cutoff | no | per key | logs, editable |
| Native and third-party spend caps | yes | yes | no | no | no |
| GVNR | live | per agent and per fleet | yes, before it runs | yes | hash-chained |
A spend cap answers "can it afford this?". It has no opinion on curl | sh, on rm -rf, or on reading your .env, all of which are cheap. GVNR asks a different question: is this actor permitted to do this, right now, and who authorised it.
Piping the internet into a shell is refused outright. Deleting a tree, rewriting git history, reading credentials, publishing or deploying: those stop and ask you. Ordinary work passes untouched. These are capability decisions rather than spend ones, so they fire with a full budget.
OpenRouter is worth calling out because the two compose rather than compete. It picks a model per turn and bills you for it. A marketplace has no reason to ship a hard stop, so GVNR sits in front and supplies the limit that actually stops an agent, the check on what it may do, and the receipt.
It does not detect hallucination. Nobody can do that reliably, and claiming it would be the fastest way to lose the argument. It catches mechanical waste that is genuinely detectable, blocks capability misuse, and escalates judgment calls to you.