Function Duration Billing

Function duration billing charges based on how long a serverless function runs and how much memory it consumes. In AI applications, long token streams can make this model expensive because the system pays while it waits for model output rather than processing short web requests.

Expanded Definition

Function duration billing is the pricing model used by many serverless platforms, where cost accrues for the time a function is executing and the resources assigned to it, typically memory and sometimes CPU or provisioned concurrency. In cloud and AI workflows, the practical meaning is broader than “per request” billing because the meter keeps running while the function waits on upstream APIs, model inference, or streaming token generation. That makes it a material concern for teams building retrieval-augmented generation pipelines, event handlers, and agentic workflows. NIST’s NIST Cybersecurity Framework 2.0 does not define billing mechanics, but it remains useful for framing governance around resilience, supplier risk, and operational oversight when usage-based cloud services are involved.

The concept is often confused with simple request counting, but duration billing is specifically tied to execution time and resource allocation. Definitions vary across vendors because some platforms round duration, separate cold-start overhead, or charge additional fees for networking, storage, or provisioned capacity. The most common misapplication is assuming short code paths guarantee low cost, which occurs when a function spends most of its runtime waiting on model output, retries, or slow third-party dependencies.

Examples and Use Cases

Implementing function duration billing rigorously often introduces cost uncertainty, requiring organisations to weigh flexible scaling against harder-to-predict spend.

• A customer support assistant streams an LLM response token by token, and the function is billed for the full time it remains active.
• A serverless orchestrator calls multiple APIs in sequence, so idle wait time still contributes to the bill even though little local computation occurs.
• An NHI control plane uses functions to validate tokens and rotate secrets, and long external checks increase per-invocation cost.
• A monitoring pipeline enriches security events before sending them to a SIEM, and retries or backoff logic extend execution duration.
• An agentic workflow invokes tools repeatedly, so platform charges grow with each pause, handoff, and response cycle rather than with output volume alone.

For teams designing event-driven systems, the relevant question is not only how many invocations occur, but how long each invocation remains active. Guidance from NIST CSF 2.0 is helpful here because cost visibility supports governance over service continuity, supplier dependencies, and operational efficiency. In practice, even well-architected functions can become expensive when they are used as synchronous wrappers around slow AI or identity services.

Why It Matters for Security Teams

Security teams need to understand function duration billing because it changes how cloud, identity, and AI systems behave under load, failure, and abuse. A compromised workflow can be abused for cost amplification by triggering repeated long-running executions, especially where functions call external model endpoints, identity providers, or secret stores. In NHI-heavy environments, duration-based spend also reveals whether service accounts, tokens, and automation identities are driving unnecessary latency through overbroad approvals or repeated authentication checks. The billing model therefore intersects with governance, resilience, and abuse resistance rather than just finance.

Operationally, the risk is that teams treat serverless as inherently cheap and then discover that wait time, retries, and streaming outputs are the dominant cost drivers. That becomes especially relevant for AI systems built on event handlers, tool-using agents, and token-heavy generation paths. For architecture and supplier oversight, the NIST Cybersecurity Framework 2.0 supports the wider control conversation, while NIST CSF’s governance emphasis helps teams align technical usage patterns with accountability. Organisations typically encounter unexpected cloud spend only after a runaway workflow, at which point function duration billing becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between function calling and MCP for enterprise security?
• When does MCP make more sense than function calling?
• What is the difference between application RBAC and function-level permissions for MCP?
• What breaks when privilege duration is measured in calendar time instead of task time?