Who should own cost optimization for AI agents in production?

Cost optimization should be owned jointly by engineering and the team running the agent, with clear accountability for telemetry, code changes, and review. The platform can surface the expensive spans and even propose fixes, but humans still decide what ships. That separation matters because some cost reductions are product trade-offs, not purely technical tuning.

Why This Matters for Security Teams

When AI agents move into production, cost is no longer just a finance metric. It becomes a security and reliability signal because runaway tool calls, excessive context windows, repeated retries, and uncontrolled model selection can expose weak governance, unstable workflows, and unreviewed changes. Ownership matters because the team that can see the cost drivers is not always the team that can safely change them, especially when agent behaviour is tied to business-critical automation. Guidance from the NIST AI Risk Management Framework supports assigning accountable oversight for AI systems rather than treating them as ordinary application spend. For agentic systems, cost optimisation also overlaps with prompt design, tool permissions, and response validation, which is why NHI Management Group treats it as an operational control issue, not just a FinOps concern. In practice, many security teams encounter agent cost explosions only after a production workflow has already been scaled widely, rather than through intentional governance.

How It Works in Practice

The best operating model is shared ownership with explicit boundaries. Engineering usually owns the code path, model routing, caching logic, and instrumentation. The product or operations team running the agent owns workflow priorities, acceptable latency, and the business trade-offs that define whether a cost-saving change is safe. Security or platform governance should own policy enforcement for tool access, telemetry retention, and change approval where the optimisation affects risk.

That division works best when every expensive action is measurable. Track token use, tool invocations, retry loops, retrieval volume, and escalation frequency per task type. If an agent relies on retrieval-augmented generation, the retrieval layer often becomes a hidden cost center, so the team should test whether smaller context windows, stricter retrieval filters, or task-specific prompts reduce spend without harming accuracy. Where the agent has execution authority, cost review should also consider whether a cheaper path expands privilege or increases the chance of unsafe shortcuts.

• Assign one accountable owner for the telemetry pipeline so cost data is trusted.
• Separate proposed fixes from approval authority so cheaper does not automatically mean safer.
• Review cost by workflow, not just by model, because orchestration overhead can dominate.
• Use change review for prompt, tool, and routing updates that alter production spend.

Current guidance suggests treating cost anomalies like control failures: investigate the spike, identify the workflow change, and decide whether the fix is technical, procedural, or product-level. For agentic systems, the OWASP Top 10 for Agentic Applications 2026 is useful because it highlights the kinds of behaviour that often create both security and cost risk, such as unsafe tool use and overbroad autonomy. These controls tend to break down when production agents share a single budget across multiple business units because attribution becomes too coarse to drive accountable action.

Common Variations and Edge Cases

Tighter cost control often increases operational overhead, requiring organisations to balance savings against latency, engineering time, and governance friction. That tradeoff is most visible in environments where many agents reuse the same model gateway or where one team owns the platform but several teams own the workflows. In those cases, best practice is evolving: some organisations place spend ownership with the platform team, while others keep it with the product team that benefits from the automation. There is no universal standard for this yet, but accountability should always follow the lever that can actually change the outcome.

Edge cases also matter. If an agent supports regulated processes, cost optimisation must not reduce logging, human review, or rollback capability. If the agent uses external tools, cheap retries can become expensive incidents when they trigger rate limits or duplicate actions. If the system includes autonomous planning or long-running tasks, cost spikes may indicate a reasoning loop rather than a simple infrastructure issue, which is where the MITRE ATLAS adversarial AI threat matrix can help teams think about abnormal behaviour patterns. The right owner is therefore not just the person closest to the invoice; it is the person with authority to change the workflow without weakening control.

Related resources from NHI Mgmt Group

• Who should own AI governance when agents connect to production systems?
• Who should own policy for AI coding agents in production?
• How should security teams limit the risk from AI agents that have access to production systems?
• Should organisations delay production AI agents until identity governance is mature?