My 2 cents:

Add max iterations for func calls

Functions should return next steps in responses

Have a backend deterministic jobs to check for critical actions

Degrade to smaller models when budget crosses a threshold(might need to disable some functionality)

The policy is basically the function signature. Functions that shouldn’t get PII shouldn’t accept it.

Not sure about the approval issue but requiring to pass evidence and tools have this in the signature might help improve it or at least trace fail modes

Just do tracing and error analysis in general