An AI cost incident runbook should connect the provider bill to the exact runs involved, preserve the state of interrupted work, name the approved intervention, and define the evidence required before restart.
Start with a financial and technical control total
The incident record begins with the provider cost for a fixed window and the internal usage assigned to that same window. The ledger groups spend by provider, model, run, feature, and customer, while an exception table preserves unmatched calls and reporting delays. This prevents the investigation from treating an estimated runtime number as a final billed amount.
The technical timeline lists the first abnormal event, threshold crossings, retries, tool cycles, alerts, operator actions, and the final pause or stop. Each event uses one run identifier so an engineer can move from the cost line to the trace without reconstructing the relationship from timestamps alone.
Name who may stop and restart each workload
The runbook should distinguish an automatic limit from an action requiring approval. AWS exposes both patterns for budget actions, and the same operational choice applies to model workflows. A low-value retry storm can stop automatically, while a customer-facing batch may pause and ask an owner to decide whether preserving the deadline justifies further spend.
The escalation path records the primary owner, backup owner, decision channel, and response timeout. When nobody responds, the default action should already be written. The safest default depends on the workload, but an absent approver should never leave an expensive loop running by accident.
Require evidence before reactivation
Restart evidence includes the identified cause, changed threshold or code path, replay result, expected cost of queued work, and an explicit buyer approval. The first reactivated run should use a tighter temporary ceiling and produce a reconciliation entry of its own. That record proves the repaired path rather than relying on the absence of another alert.
Where the service stops
Reality Contact, LLC implements measurement and buyer-approved technical controls, but does not choose product budgets, set customer pricing, move money, access production secrets through the public form, or promise a particular savings amount. The buyer approves identifiers, budgets, thresholds, and intervention permissions, then decides when the measured workload can restart under the installed controls. The work is technical implementation and operational documentation, and it does not replace financial, tax, legal, or investment advice. Provider exports can arrive late or be revised, so runtime estimates remain estimates until the ledger reconciles to the provider cost record.
Sources: AWS budget control actions; CloudZero cost connection documentation.