If you plan to retire an AI gateway because Agent Fabric now has spend caps, test those caps first: Salesforce sells them as hard limits, and MuleSoft's documentation describes them as approximate. Salesforce's October 27 announcement says the FinOps Dashboard and Model Wallet provide "hard limits that stop requests before costs exceed budget." The Model Wallet documentation says budgets are not a real-time hard cutoff and that usage "can briefly exceed a limit" before requests are blocked.
Agent Fabric is still a credible way to meter and contain agent traffic if you are already on MuleSoft, and approximate enforcement is normal for this kind of product. The buying decision turns on how far the caps overshoot on your traffic, which models your routes fall through to, and which announced features you can use today.
What Salesforce Shipped and What Waits Until January
Only part of the October 27 announcement is available to use today. Salesforce's availability list splits the release this way:
| Capability | Status on October 27, 2026 |
|---|---|
| FinOps Dashboard, Model Wallet, Cost Optimization Policies | Generally available |
| Agent Kill Switch | Generally available |
| Open Policies for Federated API Gateways | Generally available |
| Agent Evals, API Evals | Beta in November 2026, GA January 2027 |
| Custom Agent Scanner | Beta now, GA January 2027 |
| Triggered-Agent Kill Switch | GA January 2027 |
The announcement's most attractive sequence is the one that is not finished. It describes Agent Evals catching a quality failure in production and triggering an intervention such as the kill switch. Both the evals and the triggered kill switch are still ahead, and Salesforce's own page warns that it may reference unreleased features and that customers should decide on what has shipped. VentureBeat's report describes the retailer example in that sequence as hypothetical, so treat it as a design goal with no customer result behind it.
The cost controls are also young. MuleSoft's release notes list budget management and model wallets as new on August 31, 2026. The October 14 entry fixes a wallet save failure on Amazon Bedrock budgets and a bug where changing model proxy routes reset a client identifier and interrupted token tracking.
How Hard Is a Model Wallet Cap?
A Model Wallet cap blocks requests shortly after a limit is reached, and MuleSoft publishes no maximum for the overshoot on the pages cited here. A Model Wallet identifies a caller of Model Proxy and caps that caller's token or dollar spend. A budget sets a daily, weekly or monthly limit on one wallet, provider and model combination, measured in US dollars or tokens.
Three behaviours in the wallet documentation change what the word "cap" means for a finance team.
A capped request can move to another model. When a budget is reached, the proxy blocks further requests to that provider and model. If the route has a fallback, requests go to the next model on the route instead. Each wallet, provider and model combination carries its own budget, so by inference a route with three models needs three budgets, and your real ceiling is their sum. Any fallback model without a budget has no cap of its own.
A missing price reads as zero. Spend budgets depend on the costs you configure on the Models page. MuleSoft says models without configured costs show zero spend and that spend budgets for them will not track accurately. Token usage is still counted, so a token budget does not have this problem.
Dollar history starts when you enter the price. The cost management guide says dollar figures accrue only from the time you set costs, with no retroactive calculation. It also says usage that never reaches Model Proxy is outside these controls, so an agent calling a provider directly with its own key does not appear.
The marketing runs ahead of those pages. MuleSoft's cost management product page calls Model Wallet "locked-in spending controls your agents can't overrun." A team that reads only that sentence will set a monthly limit equal to its real budget and be surprised.
How the Caps Compare With Kong, LiteLLM and Portkey
Agent Fabric's enforcement gaps resemble those in competing gateways, so the documentation does not by itself justify keeping or replacing what you run. Our August comparison of AI gateways and API management reached a similar view of managed platforms, and the current docs support it across this group:
| Gateway | At the limit | Known gap in enforcement | With no price configured |
|---|---|---|---|
| MuleSoft Agent Fabric | Blocks, or falls back if the route has a fallback | Usage can briefly exceed the limit | Shows zero spend; token budgets unaffected |
| Kong AI Gateway | Returns HTTP 429 | A response's cost is only reflected during the next request | AI Gateway 2.3 and later uses a price catalog when no cost field is set |
| LiteLLM | Rejects requests; budget fallbacks are optional | Reserves estimated cost before the call; disabling that can let concurrent requests exceed a budget | Checks are skipped only when both cost fields are explicitly set to 0 |
| Portkey | Expires the virtual key | The page does not address lag | Requests logged at 0 cents do not count toward a budget |
Two differences deserve a line on your evaluation sheet. LiteLLM's reservation step tackles the concurrency problem directly by holding estimated cost before the request runs. Kong's price catalog reduces the risk of an unpriced model reading as free. The MuleSoft pages cited here describe neither behaviour, which makes your own test more useful than a feature checklist.
Federated reach is the argument on the other side. Open Policies apply rules such as IP allowlisting or rate limiting across Azure, Apigee and Kong gateways in one action, and VentureBeat notes that coverage depends on supported integrations. For a company with several gateways, one policy layer may be worth more than tighter cap arithmetic. That is an argument for putting Agent Fabric over your existing gateways, and it gives you no reason to remove them yet.
What Falls Through When the Budget Is Hit
Fallback keeps an agent running at the cost of a model change that nobody approved at that moment, and the change has its own price. Our analysis of model routers and prompt caching showed how a mid-session model switch can forfeit a cache discount. A budget-triggered fallback is a switch of that kind, and it arrives when the team is already over its limit.
Salesforce's own example makes the quality risk plain: a retailer moves an order-support agent to a cheaper model to cut operating costs, and evals catch the inaccurate delayed-order answers. Those evals are scheduled for beta this month. If your route falls back today, you need your own quality check on the fallback model, or you should remove the fallback from routes where a wrong answer costs more than a blocked one. Our model router buyer's guide makes the case for buying failover and keeping model selection in your own hands.
What the Agent Kill Switch Stops
The generally available kill switch blocks an agent's access to the model proxies where you have applied the policy, after a person decides to quarantine it. MuleSoft's containment documentation says Rogue Agent Detection only flags risky behaviour for review, and that quarantine starts after you review the flagged activity. The January triggered version is the one meant to connect detected problems to policy-driven intervention.
Setup is more demanding than the name suggests. The same documentation requires Omni Gateway 1.13.5 or later, a non-human account per agent in your identity provider, JWT Validation on each model proxy, and both policies applied to each proxy you want to protect. The two policies must use the same agent identity selector, or the flagged identity is not the one blocked. Detection also consumes extra inference calls, so the safety layer adds to the bill it helps you watch.
VentureBeat identifies the larger limit: blocking gateway access does not necessarily stop every process on the external platform. An agent cut off from its model may still hold a running job or a connection to another system that does not pass through the proxy. MuleSoft's mid-year release post lists scopes from a single request to an entire tenant, along with soft and hard stops. Check those scopes against the current policy reference, because the containment page does not document them. Our account of OpenAI's failed agent shutdown shows why a shutdown needs testing against the egress paths an agent can reach.
What the 75% Savings Claim Covers
Salesforce's token savings figure is a test result, and your production number depends on which policies your traffic can use. The announcement says Cost Optimization Policies cut token usage by up to 75% "based on test scenarios" and gives no workload detail in that claim.
The documentation sets narrower conditions. Request Compression does not support Local Mode, processes only JSON POST requests, and uses per-agent allowlists with no allow-all option, so an agent missing from the list gets no compression from that feature. When a body cannot be parsed or compression does not shrink it, the original request passes through and no savings are reported. Some Clean Payload options are lossy, such as removing null values, so leave them off until you have tested them.
Semantic caching stores a response and reuses it for a similar request. The Model Proxy release notes name Azure AI Search as its vector database, which is an added dependency if you are not on Azure. A wrong cache match also returns a stale or incorrect answer at very low cost, so measure the error rate alongside the savings.
On price, MuleSoft's pricing page lists a $2K monthly starting package and a $50K annual minimum for its Pre-Commit option, with a contact-sales button on the agent package. VentureBeat cautions that the $2,000 figure is not a standalone Agent Fabric price and reports no separate public price for Agent Evals or API Evals. Get the Mule Credit cost of your expected request volume in writing before you compare it with a gateway you already run.
How to Test Agent Fabric Before You Decide
This Week:
- Export every model on every production route and mark which ones have configured costs in Agent Fabric. Any blank is a model reporting zero spend.
- Set costs now, even if you are only evaluating, because dollar history does not backfill.
- Find the traffic that skips Model Proxy. Ask each agent team which provider keys its agents hold, then compare the answers with your provider invoices.
This Month:
- Give a non-production wallet a small budget and run a concurrent burst against it. Record spend at the moment of the first block and the final figure, and use the difference as your overshoot number.
- Repeat the burst on a route with a fallback, with and without a budget on the fallback model, and record what the agent does in each case.
- Set one budget in tokens and one in dollars on the same traffic, then reconcile both with the provider's invoice.
- Quarantine a test agent during a long-running task. Have the agent's owner confirm which tool calls and external jobs continued after the proxy block.
Before Renewal or January GA:
- Ask your Salesforce account team for a documented maximum overshoot and a written statement of how "hard limits" applies to Model Wallet.
- Get Mule Credit pricing for your request volume, and pricing for Agent Evals at GA.
- Run the beta evals on your cheapest fallback model, the one most likely to take traffic when a budget runs out.
- Keep your current gateway until the burst, fallback and quarantine results are on paper and your platform and FinOps leads have signed them.
The Bottom Line
Cloud cost tools taught buyers this lesson once already. AWS Budgets updates up to three times a day and warns that you may exceed a threshold before a notification reaches you. Gateway-level AI caps sit much closer to the request than that, and blocking a request is a stronger control than sending an alert. They still have a measurable gap, and the budget you set should leave room for it.
Salesforce has a real product for teams already running MuleSoft, with over 1.2 billion requests a day by its own count and named customers including GE Appliances and Newell Brands. Set each wallet limit below the amount you cannot exceed, by the overshoot you measured in your burst test.
Continue Reading
- AI Gateway vs API Management: No Managed Gateway Caps Your Spend
- Best FinOps Tools for AI Spend: No Dashboard Fixes an Untagged Key
- Model Router Buyer's Guide: Buy Failover, Not Judgment
- Your Agentforce Bill Depends on How Many Actions an Agent Takes
- Snowflake Takes Cortex AI Gateway GA, Previews Business Ontology
- Agent Fabric: Salesforce's Bet on 150,000 AI Agents