Cloud cost anomaly detection
Finance flags your team's cloud bill after every spike, and someone burns a day tracing the cause. Design an agent that investigates cost anomalies: how it attributes a spike to a service, team, or deploy, what it does when the spike is expected — a launch, a backfill — and what authority it has over spend, if any. How would you tune it so its alerts stay credible, prove that with data, and pitch it to engineering and finance together?
triage_cost_anomalies(spike_rows: list[str], expected_events: list[str], alert_threshold_pct: float) → list[str][["payments|42.0|deploy-1841|2026-01-31","search|6.0|deploy-1902|2026-01-31","ledger|55.0|none|2026-02-01"],["checkout@2026-01-31"],25]out["alert:payments:deploy-1841","digest:search","unattributed:ledger"][["checkout|80.0|backfill-77|2026-02-02"],["checkout@2026-02-02"],25]out["expected:checkout"][["media|25.0|deploy-2001|2026-02-03"],[],25]out["alert:media:deploy-2001"]Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.