# Brakes

URL: /agents/autonomy-levels/brakes · Id: `page:agents/autonomy-levels/brakes`

> A brake stops one class of effects, such as sends, spend, publishes or price changes, across many Startups at once, until it expires or is lifted.

A brake stops one class of effects (sends, spend, publishes or price changes) across a set of [Startups](/business/nouns/startup) at once. Readings trip most brakes; a watcher pulls the rest by hand.

## What a brake stops
A brake is a [Setting](/business/nouns/setting) with a scope, the effects it stops, a reason and an expiry. Its scope is a [Portfolio](/business/nouns/portfolio) query: one Startup, a [Cohort](/business/nouns/cohort), every Startup on one [Startup Template](/business/nouns/startup-template) [Version](/business/nouns/version), or the whole Portfolio. Every Startup in scope inherits it.

While a brake holds, each new [Action](/business/nouns/action) with a braked effect stays `pending`. Nothing already done is undone; [revert by query](/agents/autonomy-levels/recovery-and-proof#revert-by-query) does that. When the brake lifts, the held Actions resume their review and delay windows.

```ts
import { $ } from 'startup-builder'

const { brake } = await $.Portfolio.brake({
  portfolio: 'directories',
  query: 'template.version = "4.2.0"',
  effects: ['publish'],
  reason: 'Checkout conversion fell below its guardrail on the first three Startups.',
  until: '2026-11-03T17:00:00Z',
})

await $.Portfolio.lift({ portfolio: 'directories', brake: brake.$id, reason: 'Version 4.2.1 fixes checkout.' })
```

A brake never waits for a window. Stopping is always safe to do at once, so a brake takes effect the moment it is set.

## Automatic brakes
| Trip | Reading | What stops |
| --- | --- | --- |
| Runaway volume | Outbound [Messages](/business/nouns/message), refunds or payouts pass three times their trailing seven-day average in an hour. | That effect, for the Startup that produced it |
| Bad version | The first Startups on a new Startup Template Version breach a guardrail [Metric](/business/nouns/metric). | Publishes, for every Startup on that Version |
| Guardrail breach | A [Play](/business/nouns/play) rollout breaches a guardrail Metric in its Cohort. | The Play's effects; the rollout reverts |
| Shock invoice | A bill arrives at more than three times its trailing average. | Payment of that bill |

Each trip records a [Decision](/business/nouns/decision) for the owning [Role](/business/nouns/role) to resolve. A freeze is a brake set ahead of time, such as no price changes across a Portfolio during a holiday week.

## Spend states
Every budget runs in one of three spend states. A tripwire moves it down one state at once; moving back up is a Decision.

| State | What may be spent |
| --- | --- |
| `FREE` | Anything inside a standing envelope with tripwires, such as ads up to $200 a day while acquisition cost stays under target. |
| `TIGHT` | Only spend against a signed [Campaign](/business/nouns/campaign) order: a [Mandate](/business/nouns/mandate) with an amount, a condition and an expiry. |
| `HOLD` | Committed obligations only, such as payroll, taxes and [Invoices](/business/nouns/invoice) owed. Anything new needs an [Approval](/business/nouns/approval) from the Role above. |

Every grant carries its condition, its expiry and the budget left, so one approval never becomes open-ended spend. Paying a shock invoice and suspending a paying customer always sit behind `HOLD`. [Spend management](/systems/spend) keeps the states.

## In practice
The [Studio](/business/nouns/studio) ships version 4.2.0 of its [Directory](/products/templates/directory) Startup Template to 30 Startups, starting with three. Within an hour, checkout conversion on all three falls below its guardrail. A bad-version brake stops publishes for every Startup on 4.2.0, so the other 27 never receive it.

The [Engineering Lead](/agents/engineering/engineering-lead) reverts the three by query and ships 4.2.1, which passes on a fresh cohort of three. The brake lifts, and the rollout continues.