Coding agent tokenomics expose the limits of seat-based AI budgeting

At a glance

What this is: This is an analysis of why coding-agent costs vary so widely and why session-level billing hides the operational cause of token overspend.

Why it matters: It matters to IAM and security teams because agent cost governance is increasingly tied to visibility, policy, and control over how software identities, tool use, and model routing behave in production.

By the numbers:

• Run the same coding-agent task more than once and the cost can swing by as much as 30x.
• RBC's token usage is up 500% year over year.

👉 Read HoneyHive's analysis of coding agent tokenomics and session tracing

Context

Coding agents change the cost model because they behave like decisioning systems rather than fixed software seats. A team can no longer assume that spend scales predictably with headcount, and the same task can produce very different token consumption depending on context length, tool loops, model choice, and fan-out across subagents.

That creates a governance gap for practitioners who need to connect usage, cost, and outcome. In identity terms, the issue is not just price control but runtime accountability for the software identities driving those sessions, which makes traceability and policy enforcement central to agent governance.

Key questions

Q: What breaks when coding-agent spend is capped without trace-level visibility?

A: A hard cap stops runaway bills, but it also blocks productive sessions because it cannot tell whether spend came from a useful run or a looping failure. Without trace-level visibility, teams lose the ability to classify work, tune routing, and explain cost variance. The result is a blunt control that reduces overspend but also suppresses valuable engineering output.

Q: Why do coding agents complicate governance for software identities?

A: Coding agents are not fixed tools that run once and stop. They act through sessions, tools, context, and delegated actions, which means their identity behaves like a runtime entity with changing access patterns. That complicates governance because the control problem shifts from static entitlement review to continuous oversight of what the agent can do, when it does it, and at what cost.

Q: How can teams tell whether agent spend is normal or wasteful?

A: They need to compare cost with outcome at the step level. A useful session may be expensive if it lands a high-value fix, while a cheaper session may still be wasteful if it loops without progress. The signal comes from linking tokens, tool calls, and final artifacts so finance, engineering, and governance teams can evaluate value together.

Q: Should organisations use cost caps or behaviour tracing for coding agents?

A: Behaviour tracing should come first because it explains why spend occurs. Cost caps are useful as a backstop, but they are blunt and can hide the very patterns teams need to fix. Once tracing is in place, caps can target true outliers while leaving productive sessions with enough room to complete their work.

Technical breakdown

Why coding-agent costs vary so sharply across sessions

Coding agents consume tokens through iterative reasoning, tool calls, and context replay, not through a fixed one-time execution. Every turn can expand the prompt history, and edits to earlier context or model switching can invalidate cache advantages and bill the session again at full input rates. Tool loops, parallel subagents, and larger reasoning models all multiply cost in ways that are weakly correlated with task difficulty. That is why two runs on the same problem can diverge dramatically in spend while producing similar outcomes.

Practical implication: teams need step-level telemetry before they can set any meaningful cost threshold.

Trace trees connect spend to the actual agent trajectory

A trace tree models a coding session as linked events rather than a single invoice line. Session start, tool calls, model events, outputs, and annotations each become nodes with cost attached at the point where tokens were consumed. That structure makes it possible to see which step, model tier, or tool generated overspend and whether the run produced a useful artifact such as a merged PR or a failed loop. The technical value is attribution, not just aggregation.

Practical implication: use trajectory-level telemetry to identify the exact step where spend diverges from value.

Model routing and outcome scoring are the control layer for agent spend

Once sessions are observable, organisations can route prompts to cheaper models when the task does not justify a frontier system and score outputs against cost. This is a governance pattern, not merely a FinOps trick, because it relies on classifying work before the agent is allowed to spend aggressively. The important point is that budgets become conditional on task quality, not just total consumption. Without outcome scoring, a cheap failure and an expensive success can still look the same in accounting terms.

Practical implication: pair routing policy with outcome evaluation so cost ceilings do not suppress high-value work.

NHI Mgmt Group analysis

Seat-based budgeting is now a weak control model for agentic work. When the same coding task can cost 30x more on a different run, the issue is not procurement variance but runtime behaviour that finance-only controls cannot explain. For identity and governance teams, that matters because software identities are no longer static consumers of licensed capacity. They are active decisioning entities whose tool use, model choice, and session length need policy. The practitioner conclusion is that cost governance has to move closer to execution.

Traceability is the missing control concept in coding-agent governance. The article's core insight is that a session total cannot tell you which action created the spend or whether the output was worth keeping. That is a governance failure mode, not just an observability gap, and it maps cleanly to broader NHI oversight: you cannot govern what you cannot attribute. The named concept here is trajectory accountability, meaning the ability to tie cost, tool use, and outcome back to a single agent run. Practitioners should treat that as a control objective.

Agent cost management intersects with identity because the agent is acting as a software identity with delegated authority. Once coding tools can call shells, browse repos, and trigger downstream actions, their access pattern starts to look like privileged non-human activity. That puts the issue in the same governance family as workload identity and NHI lifecycle control, even though the article is about spend. The practitioner conclusion is to align cost controls with access controls, so expensive behaviour and risky behaviour are reviewed together.

Budget caps without behavioural telemetry create false confidence. A flat ceiling can stop overspend, but it cannot distinguish between a looping dead-end and a productive run that genuinely needed more tokens. That means the control suppresses symptoms while leaving the cause untouched. The better governance pattern is to combine spend thresholds with step-level evaluation, because only then can teams preserve useful work and throttle waste. Practitioners should see cost caps as a fallback, not a primary control.

Measured agent spend will become a procurement and risk signal, not just a finance metric. As organisations route more work through coding agents, token variability will influence which models are allowed, which tasks are delegated, and which sessions are audited. That pushes AI operations toward the same accountability expectations already familiar in identity governance. The practitioner conclusion is to prepare for spend telemetry to inform access policy, model selection, and exception handling in the same workflow.

What this signals

Trajectory accountability will matter more as coding agents move from experimentation into regulated engineering workflows. Teams that can tie spend to step-level behaviour will be better placed to separate acceptable variance from true governance failure, and that becomes especially important when software identities can call tools, edit code, and trigger downstream actions in one session.

The next control challenge is not whether to cap agent spend, but how to combine cost telemetry with access governance. That is where identity programmes, AI operations, and finance controls start to overlap, and the teams that prepare early will have a cleaner path to policy-based routing, exception handling, and audit evidence.

As agentic systems spread, organisations will need a common language for cost, outcome, and delegated authority. NHIMG's view is that this is no longer just a FinOps exercise. It is part of the broader control surface for machine identities, especially where a coding agent can influence code, credentials, or deployment workflows.

For practitioners

• Implement step-level cost attribution Track token usage by session, step, model, and outcome so finance can see the exact source of waste instead of only a month-end total.
• Route low-risk tasks to cheaper models Apply policy-based model selection so routine coding work is steered away from expensive reasoning models unless task complexity justifies them.
• Score output quality alongside spend Attach an evaluator to each run so a low-cost failure and a high-value success are not treated as equivalent in reporting.
• Review long-running loops as governance events Treat repeated tool-call cycles, invalidated cache hits, and fan-out across subagents as signals that the session needs intervention before costs compound.

Key takeaways

• Coding-agent budgets break the old seat-license model because the same task can consume radically different token volumes on different runs.
• Session totals are not enough for governance because they hide the step, model, and outcome data that explain overspend.
• Practitioners need trace-level telemetry and outcome scoring together, or cost caps will keep suppressing useful work while missing wasteful agent behaviour.

Key terms

• Trace Tree: A trace tree is a structured record of an agent session broken into linked events such as prompts, tool calls, model outputs, and artifacts. It lets practitioners see how work unfolded, where tokens were consumed, and which steps produced value or waste.
• Trajectory Accountability: Trajectory accountability is the ability to connect an agent's path through a task to its cost, actions, and final outcome. It matters because aggregated billing obscures the behaviour that created the spend, making governance and optimisation difficult.
• Model Routing Layer: The model routing layer is the policy and orchestration logic that decides which model handles a request, when to escalate, and what tools the request can reach. In AI programmes, it behaves like a control plane because it shapes data exposure, privilege boundaries, and auditability.

What's in the full article

HoneyHive's full analysis covers the operational detail this post intentionally leaves for the source:

• Step-by-step tracing of Claude Code sessions through hooks and daemon capture
• Devin exporter details for batch or daemon sync, including session metadata and billing fields
• Practical setup examples for turning session telemetry into spend attribution and model routing
• How evaluator scores can be tied to agent outputs for cost-versus-value review

👉 The full HoneyHive post covers trace trees, model routing, and outcome attribution in more implementation detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect delegated runtime behaviour to the controls that keep access accountable.