Per-key spend caps that hold
A spend cap is only real if it is enforced before the money is spent. Redline reserves the worst-case cost of a request before it leaves, so a key cannot bill past its cap even mid-stream.
The problem with after-the-fact limits
Most "limits" are checked after a response finishes. On a stream that is seconds later, long enough for a single reply to blow through a small cap. A limit you read after the spend is not a limit; it is a report.
Reserve, clamp, settle
Redline prices the worst case first and holds that amount against the key's balance. It then clamps the output length to what the hold covers, so the reply physically cannot cost more. When the response ends it settles the real cost and releases the rest of the hold. If the worst case does not fit under the cap, the request never leaves.
Caps per key
Each key can carry a lifetime cap, a monthly cap, or both. Mint one per engagement, per client or per script; revoke it when the job ends. A leaked key is bounded by its own cap, not your whole balance.