Serverless Cost Guardrails

Find paths where one request, event, bug, retry, or attacker can create an unbounded bill. Optimize for bounded loss, not merely lower average cost.

Treat application code, infrastructure configuration, live usage, and provider billing controls as separate evidence. Do not infer that a dashboard setting exists from code, or that code is deployed from a repository snapshot.

Start with the billing graph

Map each externally triggered path as:

trigger -> fan-out/retry -> metered operations -> persistence -> notification -> stop condition

Include HTTP endpoints, queues, schedules, webhooks, background jobs, AI calls, database scans, object storage, image transforms, email/SMS, observability events, builds, and data transfer.

For every metered operation, record: