Cost Governance

Definition

Cost governance is the set of controls that bound spend structurally, rather than relying on people noticing. Its design problem is the same as any governance: preventive controls that are too strict get routed around, and detective controls alone arrive too late.

Preventive controls

• Policy blocking the most expensive mistakes: instance types above a threshold requiring approval, approved regions only, no resources without an owner tag, no public data transfer without review.
• Quotas per account or team, so a runaway process is bounded by construction rather than by vigilance.
• A paved road of pre-approved, correctly-sized templates that are the easiest path — so the default choice is also the sensible one.
• Expiry by default on non-production resources.

Detective controls

• Anomaly detection on spend, alerting within a day. Month-end discovery is far too late; a misconfigured job can spend a quarter's budget in a weekend.
• Budget alerts at thresholds, to the team, not only to finance.
• Continuous unused-resource detection, reported to owners.
• Commitment coverage and utilisation, so purchased capacity is actually used.

The balance

The failure at the strict end is real and common: approval required for every resource produces a queue, and teams under deadline pressure build shadow infrastructure that is both more expensive and invisible. The failure at the loose end is a bill nobody predicted.

The workable position is preventive controls on the expensive and irreversible; detective controls on everything else; and a fast, credible path to an exception.

What must be in place first

Allocation. Governance without attribution cannot target anything — budgets cannot be set, anomalies cannot be assigned, and every conversation stalls on ownership. Mandatory tags enforced at creation are the precondition for all of the above.

Failure scenarios

• Approval gates on everything, producing shadow infrastructure.
• Alerts to finance only, so the people who can act do not see them.
• Budgets with no consequence, so they are ignored.
• Anomaly detection tuned so loosely that a doubling of spend is within tolerance.
• Governance without a paved road, so compliance is an obstacle rather than the default.

Interview question

"A misconfigured job spent a quarter's budget over a weekend. What controls would have prevented or caught it, and what would each have cost in developer friction?"