Cost management

Expected monthly cost of the customer template (about USD 725–755 at list price, before model usage), pricing the models, the four spend limits and an AWS budget.

How-to · Updated 2026-10-17 · Describes release 0.1.164

Evidence reviewed 8 October 2026 on 0.1.130 (the 16 October 2026 handover build; see the release notes); the template defaults priced here are unchanged through 0.1.133.

Price the models before relying on spend ceilings. The customer values pack sets USD 10 per investigation for a workspace with no saved override. Cloud infrastructure budgets are separate and belong at the customer's billing/payer account.

Expected monthly cost

No month of a customer-template installation has been measured: every cost line in Deployment runbook §6 reads "not measured". The figures below are AWS list prices for ap-southeast-1 at 730 hours a month, from the cost model (AWS Price List API, 13 August 2026; the RDS class re-priced 6 October 2026), applied to the template defaults in infrastructure/iac/envs/_customer-template/env.hcl. Other regions are priced differently.

Not in the total: model usage (below), data transfer, public IPv4 addresses (0.005 per address-hour), Secrets Manager (0.40 per secret a month), CloudWatch logs and alarms, RDS backup storage, the EKS secrets-encryption KMS key, support plans and tax.

What moves the figure (env.hcl defaults in parentheses):

Who sets which knob. env.hcl (the knobs above and the AWS cost guardrails under Reconcile and export) and the deployment variables in the values file (AIOPS_MAX_COST_USD_DEFAULT, AIOPS_PRICE_SYNC_INTERVAL_S, AIOPS_MODELS_DEV_PRICES) live on the vendor's customer branch: ask the vendor to change them, and the next deploy applies them. The model price map is yours, under Ops → Platform defaults → Model price map. Each workspace's four limits and its pause belong to that workspace's owners.

Model usage comes on top: on Bedrock it is billed in your AWS account, and the platform books it per run (Reconcile and export). The customer values cap each investigation at USD 10 for a workspace with no cap of its own; the daily, monthly and per-incident limits stay off until a workspace owner sets them. The one recorded per-incident figure comes from the vendor's test lab, not from a customer estate: the certified incident-agent run booked a mean of USD 0.87 of model spend per graded investigation, on the lab's models and estate (iteration playbook); the validation runs after a fix are booked on top. Read your own spend on the portal's Usage & billing page once real incidents arrive, and set the monthly limit from it.

Make booked model cost meaningful

Platform administrator: Ops → Platform defaults → Model price map.

1. Press Fetch list prices. For every model in use that the gateway serves from AWS Bedrock, the platform reads the public AWS Price List for the region the gateway calls from (global rows for a global. profile, regional rows for apac./us./in-region ids) and records input, output, cache-read and 5-minute cache-write rates with the price list's publication as the source. The control plane repeats this daily (AIOPS_PRICE_SYNC_INTERVAL_S, default 86400, 0 = off for an install without outbound HTTPS to pricing.us-east-1.amazonaws.com and models.dev; a deployment variable the vendor sets in your values file, so ask for it with the install). A gateway entry must state aws_region_name to be priced from AWS. Every model not served through Bedrock is priced at its publisher's list price as models.dev (an MIT-licensed community dataset, https://models.dev/api.json) publishes it — the publisher's own entry only — through a dated mapping: the reviewed router table maps cx/ (OpenAI), glm/ (Z.ai), ds/ (DeepSeek) and cc/ (Anthropic) aliases; every other model is mapped by the operator (Map, suggestions first). A change beyond 2x waits for Confirm. AIOPS_MODELS_DEV_PRICES=false turns this part off.
2. For a contract or discounted rate, record the price in the editor with a source note (the contract or pricing page). A manual price outranks the list price; the daily sync never replaces it unless the operator names the model (Replace with the list price).
3. Read Needs attention: every model in use without a trusted price, its 30-day spend, the estimated part and the reason (no region on the gateway entry, no reviewed AWS mapping, not mapped to a publisher model, a held change, a gap models.dev cannot state). Models priced only from AIOPS_MODEL_PRICES show as source not recorded until mapped or until someone records a note for them. A workspace on its own endpoint is priced the same way (Workspace endpoints): what its endpoint reports is never the price; an unmapped model books USD 0 as Not priced yet.

A model without a trusted price still books — from the runtime library's own price table (pinned to the release, labelled an estimate) or the AIOPS_PRICE_PER_1M_* fallback — so dollar limits keep working; every cost surface shows that part as an estimate. An unknown gateway alias with no price anywhere books USD 0 despite token consumption; its dollar-based limits cannot work. Missing cached-read pricing charges cached input at the full input rate; the breakdown flags the over-estimate. Cache writes bill at cache_write_per_1m (Anthropic on Bedrock: about 1.25× input).

Prices keep their history: a new price applies from its date and each run is priced at the price in force when it started. Re-pricing history is an explicit platform action (POST /api/aiops/admin/rebook-costs, dry run first); to correct the past, record the price with Apply from set to when it was really in force, then re-book. A price applies from its date on, over every price recorded before it (a contract rate back-dated over the AWS list price included). A save over a card that changed since the page loaded (the daily sync, another administrator) is refused: reload and edit again. Confirm rates before publishing a spend report.

Four ceilings and the pause control

The four limits and the pause are the workspace's PATCH /api/aiops/{tenant_id}/guardrails keys, named as in the table: max_cost_usd, daily_cost_limit_usd, monthly_cost_limit_usd, incident_cost_limit_usd and agents_paused. The call needs members.manage (a write-scope personal access token of a workspace owner) and changes only the keys it sends; 0 turns a limit off, and "max_cost_usd": null returns the workspace to the platform default. With example amounts:

curl -X PATCH https://<your-host>/api/aiops/<tenant-id>/guardrails \
  -H "Authorization: Bearer <workspace owner's PAT, ntp_…>" \
  -H "Content-Type: application/json" \
  -d '{"daily_cost_limit_usd": 50, "monthly_cost_limit_usd": 1000, "incident_cost_limit_usd": 20}'

Set and review the workspace's daily, monthly and incident limits explicitly; the USD 10 per-run default does not set those aggregate limits. Day/month ceilings gate starts, so concurrent runs can overshoot an aggregate ceiling. The step cap checks before the next call, so the final call can cross the numerical limit; it is not a prepaid-provider hard stop.

At 70% of a priced per-run cap the engine can step down its model ladder once. At the cap it stops without a further wrap-up call and leaves a stop notice for human handling. A pinned pillar model disables ladder routing. Best-of-2, when enabled, doubles that run's configured cap. X-ray uses the scan budget supplied at launch instead of the ordinary investigation cap. Keep each of those exceptions visible in capacity/spend planning.

Respond to a spend alarm

1. Open Guardrails & cost and inspect the exact stop reason and booked spend.
2. For unexpected spend, enable Pause all agents and account for active runs. Use Stop this run to request cancellation of a specific run and verify its terminal state.
3. Check model ids/rates, routing, incident recurrence and repeated re-analysis. Restore service only after the owner decides a justified budget or manual handling path.
4. Daily starts resume after UTC midnight, monthly starts after the next month starts, or when a permitted owner raises the limit. A paused workspace requires an explicit resume.

The external AiopsBudgetTrip rule sees first trips and should page an independent receiver. It does not discard incoming signals.

A scanner pull can start paid model work in three ways: a finding with a supported prepared fix starts its prepared-fix analysis (aiops_compliance_auto_triage, on by default); a newly pulled P1 or P2 finding starts an analysis when Analyse P1/P2 findings automatically is on (the shipped default, overridable per workspace on Guardrails & cost); and backlog catch-up, off by default, analyses already-held P1/P2 findings. Read the workspace's effective switches and the day's actual spend before a manual pull, and review the Scanner sync interval together with the workspace limits. Keep a price-source failure apart from a model-call failure: Not priced yet is a missing price, not a zero-dollar cost, and an estimated price is not a provider invoice.

Reconcile and export

Ops Billing rolls up model spend by workspace and class for a UTC calendar month. Use Download CSV for that month; it has one row per workspace/class plus a grand total, its estimated_usd column is the part of each cost priced from an estimate, its unpriced_tokens column the tokens no price was recorded for (they show $0: resolve them before invoicing), and its free_checks column the validations that ran no agent ($0; runs counts agent runs only). Operating, verify, discovery and test classes are distinguishable, and lab spend has its own subtotal. The API counterpart is GET /api/aiops/admin/billing.csv with an admin-scope platform token. The portal's Spend views and incident breakdowns explain runs, cached reads, cache writes and the source of each price; the estimated part of a month is marked on Ops Billing and on the workspace statement. Benchmark spend is excluded from operating rollups; report test cost separately. Reconcile booked token pricing with provider invoices and note changes to rates or re-booked history in the monthly report.

Token reconciliation with AWS. Run, in the control-plane pod, kubectl -n aiops exec deploy/aiops -- python -m app.aiops.price_sources reconcile --days 7: it compares the tokens the platform booked per Bedrock model id with CloudWatch AWS/Bedrock InputTokenCount, CacheReadInputTokenCount, CacheWriteInputTokenCount and OutputTokenCount and reports the drift per model — match within 2%, aws-higher when other callers share the account, ours-higher to investigate. Read-only; it needs cloudwatch:GetMetricData on the control plane's role and says so when that is missing. In a customer's own AWS account (BYOC), reconcile the money in Cost Explorer: filter Service to the price list's service name (for example Claude Sonnet 5 (Amazon Bedrock Edition), billed through AWS Marketplace), group by Usage type, and compare with the usage types each AWS price cites (Model price map → Prices in force) and the workspace's Usage & billing → By model for the same UTC month.

For AWS infrastructure, the cloud-finance team manages Budgets and anomaly detection in the payer account when the installation account is an Organization member. Enabling template cost guardrails in a member that does not own billing can fail with AccessDenied. In an eligible standalone account, the optional budget emails actual 80%/100% and forecast 100%; the daily anomaly summary threshold is USD 100. Confirm the alarm mailbox and existing anomaly monitor before enabling these settings. They live in the installation's env.hcl (enable_cost_guardrails, cost_budget_monthly_usd, alarm_email, cost_anomaly_monitor_arn) on the vendor's customer branch: ask the vendor to set them, and the next deploy creates the budget aiops-<slug>-monthly.

To set the budget yourself in an account that owns its billing, the same thresholds from AWS CloudShell (example amount and address; a different budget name from the template's, so a later template budget does not clash):

aws budgets create-budget --account-id 123456789012 \
  --budget '{"BudgetName":"platform-account-monthly","BudgetType":"COST","TimeUnit":"MONTHLY","BudgetLimit":{"Amount":"1000","Unit":"USD"}}' \
  --notifications-with-subscribers '[
    {"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"cloud-finance@example.com"}]},
    {"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":100,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"cloud-finance@example.com"}]},
    {"Notification":{"NotificationType":"FORECASTED","ComparisonOperator":"GREATER_THAN","Threshold":100,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"cloud-finance@example.com"}]}]'

You should see the budget under Billing and Cost Management → Budgets; each address receives AWS's alerts when a threshold is crossed. The account is dedicated to the platform, so the budget needs no cost filter.

Sources: Customer values, customer template, cost model, official price sources, Agents and guardrails, budget implementation, Platform Billing, and Deployment runbook §6.

Next steps

• Next: Set up your first customer
• All Install and operate the platform pages
• Documentation home