Self-hosting moves the loop, not every risk

Coder's Agents documentation places the agent loop, chat history, and tool orchestration in the Coder control plane. Unless the organization configures a self-hosted model endpoint, the model remains outside that boundary. The control plane sends prompts to configured providers, receives tool calls, and uses Coder's workspace connection to read files, write code, and run commands.

Individual workspaces no longer need provider keys or agent software. Agent actions carry the identity of the user who started the chat, and that user's access controls which templates and workspaces are available. Platform teams gain a central policy point.

The workspace still has teeth. Coder warns that an agent workspace gets the same network access and permissions as a manually created workspace by default. A broadly connected template gives the agent broad connectivity. Build dedicated agent templates with narrower egress and credentials before assigning sensitive work.

Our least-privilege checklist for AI agent tools covers the full path: user identity, model access, workspace templates, network routes, repository credentials, shell tools, and MCP servers. "Self-hosted" identifies the control plane's location. It does not describe what a shell command can reach.

Stored limits can remain visible and do nothing

The upgrade trap is explicit in Coder's cost-control documentation. Native Coder Agents usage limits can no longer be configured or enforced. Their values remain stored, but Coder does not translate them into AI Gateway budgets.

The replacement follows different rules:

• AI Gateway has no deployment-wide default budget. Without a group budget or personal override, a user has unlimited spend.
• The only budget period is the UTC calendar month. Old daily or weekly limits have no direct equivalent.
• If a user belongs to several budgeted groups, the default policy selects the highest limit. Native agent limits selected the lowest group limit.
• A personal override wins over every group budget.
• Enforcement covers priced traffic routed through AI Gateway. A model missing from Coder's bundled price table records tokens without adding spend, leaving that traffic effectively unlimited.

These differences change outcomes. A contractor who also belongs to a generously funded engineering group may inherit the larger budget after migration. A newly launched model may be usable before its price appears in the Coder release's price book. The dashboard can then record tokens without counting their cost.

Coder exposes coder_ai_gateway_cost_control_unpriced_token_usage_records_total for that gap. Alert whenever it is non-zero, grouped by provider type, provider, and model. The metric tells administrators exactly when the spend total is incomplete.

Write the migration down before the upgrade

Capture the old policy while it is still visible. For every user or group, record the current limit and period, group memberships, intended replacement, and the owner who will test it. Resolve the changed rules instead of copying amounts into new fields.

Give every group that should be bounded an explicit budget. An empty field means unlimited. $0 USD blocks requests when that group becomes the user's effective group. Group budgets apply per member rather than forming a shared pool. If ten members each receive a $200 USD group budget, the group's potential total is $2,000 USD.

The configured amount is not an exact accounting wall. AI Gateway learns a request's cost after the provider responds, so concurrent requests can carry a user slightly past the budget. Later requests receive 403 Forbidden once recorded spend reaches the limit.

Prove that the gateway says no

Create a temporary group with a tiny budget and use the same provider and model path planned for production. Confirm the effective group, generate priced traffic, cross the limit, and check that a later request is blocked. Verify that the 85% and 100% notifications reach the expected user and administrators.

Next, put one test user in two budgeted groups. Confirm that the higher budget wins unless a personal override exists. Exercise a model found in the current price table, then inspect the unpriced-usage metric. This reaches the denial path, which a settings screenshot cannot do.

Keep provider billing alerts as a separate signal. Coder calls its spend figure an estimate based on published model prices. Negotiated rates, provider billing rules, and missing prices can make it differ from the invoice. Our guide to instrumenting AI agents puts cost beside task, tool, retry, and failure traces, where an unexpected bill is easier to diagnose.

Migrate APIs and organization settings together

Coder 2.37 disables and deprecates Coder Tasks in favor of the Chats API. The migration guide says the change is not a drop-in endpoint rename. The agent loop moves from the workspace to the control plane. Chat state moves into the Coder database. WebSocket streaming replaces polling, and the agent can select and provision a template when action is required.

Model configurations and overrides are now scoped to an organization. Existing configurations move to the default organization and are not copied elsewhere. MCP server configurations also move to the default organization, leaving other organizations to configure their own models and MCP servers. That isolation is useful, but an unreviewed upgrade can leave a non-default organization without a usable model.

Ship the API migration, organization inventory, network-template audit, and budget migration as one release. Coder can compile, start, and serve chat while still being wrong on the controls that matter: who can start an agent, what its workspace can reach, and whether model traffic stops at the intended amount.