'FinOps for AI Agents: Who Spent All the Tokens? - Tisha Chawla & Susheem Koul, Microsoft'

AI agent workflows require a shift from token maximization to value maximization through run-level cost governance, achieved via an out-of-band control plane...

By Sean Weldon

FinOps for AI Agents: A Governance Framework for Run-Level Cost Control

Abstract

This paper examines Token Ops, a governance framework addressing runaway cost challenges in autonomous AI agent deployments. Current industry practices prioritize token maximization over value optimization, resulting in catastrophic budget exhaustion where organizations deplete multi-million dollar allocations within months or days. Existing control mechanisms operate at the request level, failing to capture the run-level cost drivers inherent to agent workflows such as iterative loops, context accumulation, and autonomous tool invocations. Token Ops introduces an out-of-band control plane architecture that monitors, attributes, and steers agent behavior through boundary annotation and policy-based governance rather than simple budget gating. Empirical benchmarking on open-source agent frameworks demonstrates 78% average spend reduction while improving completion rates from 67% to 96% compared to throttling-only approaches. This framework establishes foundational principles for cost control in agentic systems and provides a production-ready architecture for sustainable AI agent deployment.

1. Introduction

The deployment of autonomous AI agents has introduced unprecedented challenges in cost management and operational governance. Unlike traditional software systems where resource consumption follows predictable patterns, AI agent workflows exhibit emergent behaviors that generate unbounded costs through runaway loops, context bloat, and excessive tool invocations. Organizations have reported exhausting substantial AI budgets within compressed timeframes - one case involving a four-month depletion of allocated resources, others reaching hundreds of millions in expenditure within days. These incidents highlight a fundamental misalignment between current control mechanisms and the operational requirements of agentic systems.

The core challenge stems from an industry-wide emphasis on token maximization - spending the maximum available tokens - rather than value maximization, which optimizes for delivered outcomes relative to resource consumption. This misalignment persists because existing cost control infrastructure operates at the request level through model gateways, hard caps, and routing policies. These mechanisms cannot address the run-level cost drivers that characterize agent behavior, such as iterative tool calling sequences, context accumulation across multiple reasoning steps, and autonomous decision-making loops that may execute indefinitely without proper governance.

Furthermore, current systems lack cost traceability: organizations cannot attribute expenditures to specific agent runs, component invocations, or user cohorts. This attribution gap prevents root cause analysis of cost overruns and precludes the development of targeted mitigation strategies. The absence of visibility into which agent runs, tool calls, or components generated specific costs renders post-hoc optimization impossible and forces reliance on blunt instruments like global budget caps that terminate agent execution without addressing underlying inefficiencies.

This analysis examines Token Ops, a comprehensive governance framework designed to shift the paradigm from reactive budget capping to proactive cost steering. The investigation establishes first principles for cost control in agentic systems, details the architectural components enabling run-level governance, and presents empirical evidence demonstrating substantial cost reduction while maintaining or improving task completion rates.

2. Background and Related Work

2.1 Evolution of Cost Control Paradigms

Cost control mechanisms have evolved across three distinct software eras, each characterized by different consumption models and control approaches. The SaaS era employed user interface-based interactions with control exercised through usage caps, seat limits, and tier-based policies. Human users interacted with applications through graphical interfaces, enabling straightforward metering and throttling at the user session level.

The cloud era introduced pay-as-you-go models where infrastructure costs scaled dynamically with demand. Control mechanisms evolved to include autoprovisioning and autoscaling policies that balanced performance requirements against cost constraints. These systems operated on infrastructure-level metrics such as CPU utilization, memory consumption, and network throughput, with well-established patterns for resource optimization.

The agentic era represents a fundamental departure from prior paradigms. Cost is calculated via model calls initiated programmatically by autonomous agents rather than human users or predictable infrastructure patterns. Critically, the agentic era lacks a proper control plane for code-initiated model calls. This architectural gap renders previous control mechanisms inadequate, as they lack visibility into agent run structure, cannot attribute costs to specific components or decisions, and operate at granularities misaligned with agent behavior patterns.

2.2 Limitations of Request-Level Controls

Current industry practice employs model gateways, routing policies, and budget caps as primary cost control mechanisms. These tools operate at the request level, treating each individual LLM invocation as an independent transaction. However, agent workflows consist of interconnected sequences of model calls, tool invocations, and reasoning steps that constitute a single logical agent run. Request-level controls cannot capture the cumulative cost dynamics of these runs or identify the structural patterns that drive excessive consumption.

For instance, a retrieval-augmented generation (RAG) tool might retrieve twenty document chunks, but the agent's language model may only utilize the first five chunks in its reasoning process. Request-level monitoring observes only the token counts of individual calls, missing the inefficiency of retrieving and processing fifteen unused chunks. Similarly, runaway loops where agents repeatedly invoke the same tools without making progress appear as legitimate individual requests rather than pathological behavior requiring intervention.

3. Core Analysis

3.1 First Principles for Agentic Cost Control

Token Ops establishes five foundational principles for cost governance in agent systems. First, the token must serve as the unit of both cost and value measurement. Unlike infrastructure metrics, tokens directly quantify both the resource consumption (cost) and the information processing capacity (potential value) of agent operations, enabling unified optimization.

Second, cost creation occurs at the LLM model call boundary - this represents the precise location where tracking must occur. Every model invocation generates measurable token consumption, and instrumenting these boundaries enables comprehensive cost visibility without requiring modifications to agent reasoning logic.

Third, attribution is critical: systems must identify which agent run, tool call, or component caused each cost. Without attribution to user dimensions, agent identifiers, and run-level contexts, organizations cannot perform root cause analysis or implement targeted optimizations. The framework must maintain a ledger that traces every token expenditure to its originating context.

Fourth, policies should address root causes before resorting to budget caps. Root causes include context growth from excessive retrieval, unbounded loops from poor progress detection, and tool output bloat from unfiltered data sources. In-place compaction, caching, and behavioral steering should precede termination-based controls.

Fifth, halting via budget cap should be the last resort, not the primary control mechanism. Budget caps terminate agent execution, preventing task completion and destroying any value the agent might have generated with continued operation. Effective governance prioritizes steering mechanisms that modify agent behavior to operate within budget constraints while maintaining progress toward task completion.

3.2 Out-of-Band Control Plane Architecture

Token Ops implements an out-of-band control plane design that operates independently from agent code execution. This architectural choice prevents interference with agent reasoning logic while enabling comprehensive monitoring and intervention capabilities. The control plane does not sit in the execution path of model calls; instead, it receives telemetry asynchronously and communicates actions back through a dedicated channel.

The architecture comprises three core modules. The Instrumentation module provides telemetry collection, cost tracking, and attribution functionality. It captures token consumption at model call boundaries and associates each expenditure with agent run identifiers and user dimensions. The Accounting module maintains a ledger that accumulates cost data across agent runs, enabling both real-time monitoring and historical analysis. The Enforcement module implements policies and executes halting or steering actions based on policy evaluations.

Supporting these core modules, the bridge layer contains four critical components. The Attribution component enriches telemetry with user dimensions and organizational context. Boundary Annotation establishes bidirectional communication between agent runtime and control plane without code modifications. The Governor enforces allowed actions based on developer-defined permissions. Wrap Complete enables boundary annotation on objects from model providers rather than just method calls, extending instrumentation coverage to provider-specific interfaces.

3.3 Boundary Annotation and Bidirectional Control

Boundary annotation represents a key innovation enabling non-invasive instrumentation and control. Applied at the method level without code changes, boundary annotation tracks input and output at each annotated boundary and transmits this information to the control plane. Critically, boundary annotation functions as a bidirectional channel: it not only sends telemetry upstream but also receives control plane actions and executes them via the Governor component.

The Governor node receives actions from the control plane and applies them non-destructively based on developer-defined allowed actions. For instance, a developer might configure a RAG retrieval method to permit mutate actions that reduce the number of retrieved chunks but disallow kill actions that would terminate execution. This configuration-based approach provides fine-grained control over which interventions the control plane can perform on each component.

This architecture works across agent frameworks including LangChain and others through method-level annotation. The framework-agnostic design ensures Token Ops can govern agents regardless of their underlying implementation, provided the appropriate boundaries can be annotated. The Wrap Complete method extends this capability to objects from model providers, ensuring comprehensive coverage even when agents use provider-specific APIs.

3.4 Policy-Based Steering and Cost Guard

Token Ops implements a policy catalog addressing common cost drivers in agent workflows. Policies cover spend management, context management, context compaction, tool output reduction, loop detection, and progress detection. Each policy monitors specific telemetry signals and triggers appropriate steering or halting actions when thresholds are exceeded.

The Cost Guard policy exemplifies the steering approach. Cost Guard monitors two metrics: budget consumption percentage and token velocity (rate of token expenditure). By analyzing these metrics, Cost Guard predicts when budget exhaustion will occur and preemptively injects system instructions to reduce token output. For example, when budget exhaustion is predicted, Cost Guard might inject the instruction "be more succinct" into the agent's system prompt, reducing output verbosity while maintaining task progress.

Steering actions include three types: allow (permit operation without modification), mutate (modify operation parameters), and inject (add instructions or constraints). For instance, when a RAG retrieval tool generates twenty chunks but the language model only uses the first five, the control plane can inject a mutate action limiting retrieval to five chunks. This reduces token consumption from unused context without terminating the agent run.

Preview mode enables safe policy testing by executing policies without enforcement. Organizations can deploy policies in preview mode to observe what actions would be taken and tune thresholds before enabling enforcement in production. This de-risks policy deployment and allows iterative refinement based on actual agent behavior patterns.

4. Technical Insights

Empirical benchmarking on open-source repositories including BrowserUse and MetaGPT demonstrates substantial cost reduction and completion rate improvements. Testing across multiple iterations and stress scenarios reveals that the full Token Ops policy suite achieves an average spend reduction of 78% compared to uncontrolled baseline execution. This reduction stems from addressing root causes such as context bloat, excessive retrieval, and runaway loops rather than simply capping budgets.

Critically, completion rates improve significantly under Token Ops governance. Simple throttling approaches achieve only 67% completion rates, as hard budget caps terminate agents before task completion. In contrast, Token Ops achieves 96% completion rates by steering agent behavior to operate within budget constraints while maintaining progress. This 29 percentage point improvement demonstrates that intelligent steering outperforms blunt termination-based controls.

The ledger continuously records all agent run traces with full attribution, enabling post-hoc analysis and policy refinement. Organizations can query the ledger to identify which agent runs, tools, or user cohorts generate disproportionate costs and develop targeted policies addressing specific inefficiencies. This feedback loop enables continuous optimization as agent usage patterns evolve.

Segmentation enables rollup control at multiple granularities. Budgets can be applied at the cohort level (e.g., all users tagged "AIE 2026"), agent level (e.g., all runs of a specific agent), or individual run level. This hierarchical budget structure allows organizations to enforce organizational policies at the cohort level while providing flexibility for specific agent or run requirements.

The architecture's out-of-band design introduces minimal latency overhead, as telemetry transmission and policy evaluation occur asynchronously relative to agent execution. The Governor applies actions only when policies trigger interventions, avoiding performance impact during normal operation. Boundary annotation adds negligible overhead for method interception and telemetry collection.

5. Discussion

The Token Ops framework addresses a critical gap in the operational infrastructure required for production AI agent deployment. The shift from token maximization to value maximization requires not only technical mechanisms but also organizational mindset changes. Organizations must establish value metrics for agent outputs and align cost optimization with value delivery rather than treating token expenditure as the primary success metric.

The self-learning module outlined in the future roadmap represents a significant advancement. By analyzing ledger data to identify remaining runaway cost patterns, the system could automatically generate new policies or refine existing parameters. This closed-loop learning would enable continuous adaptation to evolving agent behaviors and emerging cost drivers without manual policy development.

However, several challenges remain unaddressed. The framework assumes agents expose sufficient boundaries for annotation and that developers can identify appropriate intervention points. Agents with opaque internal reasoning or limited instrumentation points may resist effective governance. Additionally, the framework does not address adversarial scenarios where agents might attempt to circumvent governance mechanisms, though the out-of-band architecture provides some protection against such scenarios.

The policy catalog requires ongoing maintenance as agent architectures and usage patterns evolve. Organizations must invest in policy development expertise and establish processes for monitoring policy effectiveness. The preview mode capability partially addresses this by enabling safe experimentation, but policy refinement remains a manual process requiring human judgment about appropriate thresholds and actions.

6. Conclusion

Token Ops establishes a comprehensive governance framework for managing AI agent costs through run-level monitoring, attribution, and steering. By shifting from request-level controls to agent run-level policies, the framework addresses the fundamental architectural mismatch between current cost control mechanisms and the operational characteristics of autonomous agents. The out-of-band control plane architecture enables non-invasive instrumentation while providing bidirectional communication for policy enforcement.

Empirical results demonstrate that policy-based steering substantially outperforms simple budget capping, achieving 78% cost reduction while improving completion rates from 67% to 96%. These findings validate the core thesis that addressing root causes through behavioral steering delivers superior outcomes compared to termination-based controls. The framework provides a production-ready architecture that organizations can deploy to achieve sustainable AI agent operations while maintaining budget predictability.

For practitioners, Token Ops offers actionable guidance for implementing cost governance in agent systems. The first principles establish a foundation for reasoning about cost control in agentic contexts, while the architectural patterns provide concrete implementation approaches. Organizations deploying AI agents should prioritize implementing comprehensive attribution, establishing policy-based steering mechanisms, and reserving budget caps as last-resort controls rather than primary governance tools. Future research should explore self-learning policy generation and investigate governance approaches for increasingly autonomous and opaque agent architectures.

Sources

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub