1. Validate attribution
Check:- provider status and last-updated timestamp;
- actual, allocated, measured, and unallocated totals;
- token/request coverage;
- currency and billing period;
- whether the target project is isolated from shared provider usage;
- model/Agent/task dimension coverage and collector truncation warnings;
- whether scheduler statuses represent enqueue records or final task outcomes.
Unknown model as a measurement gap. Do not assign historical cost using an Agent’s current model configuration.
2. Find the change point
Compare daily cost, requests, and tokens. Align spikes with:- model changes;
- schedule creation or interval changes;
- prompt/skill deployment;
- new data sources or file formats;
- retry/error periods;
- new Agents, Hooks, or follow-ups.
3. Separate model price from volume
For each model calculate cost share, request share, token share, and effective cost per request. Then compare current official rates. Evidence for a model-price driver:- cost share greatly exceeds request/token share;
- the high-cost model’s active dates align with the spend spike;
- similarly sized tasks on a lower-cost model cost materially less.
4. Quantify schedule-required and avoidable volume
Inventory every active schedule and triggering path. Derive intended executions from interval/trigger and compare with observed runs/tasks. Split volume into:- required successful executions;
- retries after errors;
- duplicate or overlapping triggers;
- concurrent runs that repeat unfinished work;
- abandoned or no-op runs;
- follow-up fan-out.
5. Diagnose prompt and context cost
Use Agent and schedule prompt lengths as a screen, not proof. Use task message summaries to inspect:- input growth over time;
- repeated identical human prompts;
- largest messages;
- tool-result size;
- repeated system/context injection;
- low cache ratio despite a reusable stable prefix.
- overly detailed instructions repeated on every request;
- multiple skills restating the same rules;
- full conversation replay when a state summary would suffice;
- entire file sets loaded before the task is narrowed;
- variable values placed early and invalidating prompt caching.
6. Diagnose tool and data amplification
Rank tool-call names in anomalous tasks. Investigate repeated Data Lake/Blob reads, PDF/image extraction, OCR, conversions, searches, and broad directory scans. Ask:- Is the same immutable input processed in many runs?
- Is the derived text/index stored and reused?
- Can metadata narrow candidate files before reading content?
- Are large tool results returned to the model when only IDs/counts are needed?
- Does an error cause the Agent to retry the same expensive operation?
7. Diagnose output, reasoning, and loops
High output or reasoning may be appropriate. Look for:- repeated long reports when a delta would work;
- Agent handoffs that duplicate context;
- evaluator/reviewer loops without a termination condition;
- tool-call/result cycles with no state change;
- errors that regenerate an entire answer;
- model settings mismatched to task difficulty.
8. Check budget and operational controls
Report existing project budget policy, thresholds, current usage, and enforcement state. Absence of a budget is a risk-control gap, not a root cause of past spend. Do not change budgets or configuration during analysis.Finding confidence
- High: provider actuals reconcile and the driver is visible in multiple independent dimensions.
- Medium: allocation and runtime behavior align, but pricing or task detail is incomplete.
- Low: based mainly on configuration, token proxy, or a small sample.
Recommendation priority
Prioritize by:- immediate containment;
- low-risk efficiency;
- architectural context/data improvements;
- measurement gaps.