Tokens and energy.
Only where code can’t decide.

Every Kiln call is logged under the flow that made it. Rules, limits and refusals run in code, so they cost no tokens.