Because the expensive behaviour often happens inside a nested span, not at the top level. A retrying tool call, oversized retrieval, or sub-agent loop can consume most of the budget while the parent trace still looks ordinary. Span-level token attribution is what reveals the real cost driver.
Why This Matters for Security Teams
Agent loops turn cost into a security and governance issue, not just a billing problem. When a model is allowed to retry tools, expand retrieval, or delegate to sub-agents, the true consumption often sits inside nested spans that ordinary dashboards flatten away. That means teams can miss runaway usage, weak guardrails, or even malicious prompt patterns until budgets are depleted or services slow down. The same visibility gap also complicates accountability when an autonomous workflow makes the expensive decision, not the parent application.
This is why guidance from the NIST AI Risk Management Framework matters here: cost visibility supports governance, monitoring, and incident review for AI systems that can act iteratively. It also aligns with the practical concerns reflected in the OWASP Top 10 for Agentic Applications 2026, where agent autonomy and tool use create new failure modes that conventional observability misses. In practice, many security teams encounter token blowouts only after rate limits, surprise spend, or degraded response times have already occurred, rather than through intentional monitoring.
How It Works in Practice
Normal dashboards often aggregate token usage at the request, user, or service level. That is useful for broad trends, but it hides the structure of agentic execution. A single parent trace may look modest while a nested tool call repeatedly expands context, a retrieval step pulls excessive documents, or a sub-agent loops through the same task with fresh prompts. The expensive part is the path, not the headline request.
Operationally, the fix is to attribute tokens at span level and preserve the parent-child relationship between orchestration, tool execution, retrieval, and generation. That lets analysts separate a legitimate long-running workflow from a failure mode such as retry storms, prompt bloat, or an agent that cannot converge. It also helps teams spot where guardrails are failing: for example, whether the model is allowed to call tools too many times, whether retrieval is returning too much context, or whether a control loop is reissuing near-identical prompts.
- Track prompt, completion, and total tokens for each span, not only for the outer transaction.
- Tag spans by agent, tool, dataset, and retry count so the expensive component is identifiable.
- Set budgets and alerts on nested spans, especially for retrieval-heavy or multi-agent workflows.
- Correlate cost spikes with logs, traces, and output quality checks so the cause is operationally clear.
The CSA MAESTRO agentic AI threat modeling framework is relevant because token waste and control bypass often share the same root cause: poorly bounded autonomy. The MITRE ATLAS adversarial AI threat matrix also helps frame repeated tool calls and retrieval abuse as attack-enabling behavior, not just inefficiency. These controls tend to break down in high-churn multi-agent environments because traces are fragmented across services and cost attribution is lost at each handoff.
Common Variations and Edge Cases
Tighter token controls often increase engineering overhead, requiring organisations to balance transparency against implementation complexity. That tradeoff is especially visible in workflows that intentionally use long contexts, chained reasoning, or delegated sub-agents, where a raw token cap can reduce quality if it is applied too bluntly.
Best practice is evolving, but current guidance suggests distinguishing between expected heavy usage and anomalous looping. A legal review assistant, for example, may legitimately consume more tokens than a simple FAQ bot, while a support agent repeatedly reissuing the same retrieval query may indicate a broken control loop or a prompt injection attempt. The goal is not to suppress all high-cost behaviour. It is to explain why the cost is happening and whether it is acceptable.
Another edge case appears when dashboards are built around monthly spend rather than live span telemetry. That works for finance reporting but fails for containment, since token abuse in agentic systems can unfold within minutes. Where agent output quality, data sensitivity, or tool access matters, cost visibility should be treated as part of the system’s control plane, alongside policy checks and human oversight. In this context, the NIST AI Risk Management Framework remains the most stable reference point, while the Anthropic report on AI-orchestrated cyber espionage illustrates how autonomous workflows can scale harm when loops are not visible early.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent loops and tool retries are core agentic failure modes. |
| NIST AI RMF | GOVERN | Token visibility supports oversight, accountability, and AI system monitoring. |
| MITRE ATLAS | AML.TA0002 | Adversarial prompt patterns can drive repeated retrieval and generation loops. |
| CSA MAESTRO | MAESTRO covers autonomy risks that often present as runaway agent execution. | |
| NIST AI 600-1 | GenAI operational profiles need monitoring for inference-time cost spikes. |
Assign ownership for AI cost telemetry and review nested-span anomalies as governance events.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
