Spend anomaly watch

Spend surprises arrive as a single line on a statement six weeks after the decision that caused them. Watching the shape of spend weekly turns those surprises into questions asked while the answer is still cheap.

The job on one screen

Runs when	Weekly across suppliers and cost centres.
Reads	Invoices, cloud billing, subscription counts, and the last twelve months.
Decides	Which movements are real, which are seasonal, and which need a named owner to answer.
Produces	A short list with the movement, the history, and the owner.
Stops when	List posted. It never cancels or pays anything.
Tools it needs	Accounting API, cloud billing API, chat.
Autonomy to start at	Auto, once it has a logged track record. Start lower.

Optional: load a real model

Run it

What it watches, and how far is too far

Tolerances are the whole design. Too tight and everyone mutes it, too loose and it misses the thing you built it for.

Signal	Baseline	Tolerance	First thing to check
Cloud compute	8400	25%	Check for a new environment left running and for an instance type change in the last deploy.
Seat licences	3200	20%	Seat growth without headcount growth means nobody is reclaiming licences from leavers.
Contractor spend	22000	30%	Compare against approved statements of work before asking anyone an awkward question.
Data egress	900	40%	Usually one new export job or a misconfigured backup writing across regions.

Where this one goes wrong

Annual bills as anomalies

An annual licence renewal looks like a 1200% spike every year. Handle known periodicity explicitly.

Blaming the wrong owner

Cost allocation is usually approximate. Say who probably owns it and ask, do not accuse.

Alerting on small absolutes

A 300% increase on a 40 currency line is noise. Require both a percentage and an absolute floor.

How you would know it is working

Measure	Why that one
Cost questions asked within the month	The point: closing the loop while the change is still recent.
Savings attributed to a flag	Track it, because this is one of the few agents with a direct financial return.
False alarms	Above one a week and finance stops opening the message.

Earning more rope

Assist	Monthly report to finance.
Approve	Weekly automatic alerts with owners tagged.
Auto	Fully automatic, since it is read-only. Cancelling anything remains human.

Percentage and absolute, both. That one rule removes most of the noise that makes cost monitoring get switched off.

Related: Cloud and LLM cost · Vendor renewals · Anomaly explainer · all agent jobs · Agent Lab home

Free from AI School - no signup, everything runs in your browser.