Use case
How to detect a runaway AI agent before it burns your budget
A budget cap stops the bleeding once it is hit. Detection is what can catch it earlier than that.
Run runaway-spend detection from the dashboard to check every agent and workflow against its own recent baseline. A spend pattern well outside that baseline is raised as an alert and delivered to a Slack or Discord webhook, or any custom webhook you configure.
How Spendline does this
Every call is logged as it happens, so a spend baseline per agent or workflow is always current. Detection itself runs on demand, triggered from the dashboard, rather than on a fixed schedule; a new alert is only written after it is durably saved, so nothing gets announced that the ledger has no record of. Delivery goes out over whichever webhook you have configured, Slack, Discord, or a generic endpoint. Separately, where the hourly burn-rate check is switched on for an account, it reads every hierarchical budget, at any scope including one tied to a single agent or team, and warns before that budget is on track to run out, regardless of its strict_mode setting; a legacy account-wide budget is outside what it reads. The other lane stays org-only: the threshold alert evaluated synchronously on each proxied call only resolves an org-level or legacy account-wide budget, so that specific alert never fires for one scoped to a single agent.
Why it matters
A hard budget cap is the last line of defense, not the first. Running detection regularly, and reviewing what it turns up, is what turns a budget cap from "the way we found out" into "the safety net we never needed."
Frequently asked questions
Does detection run automatically, or do I have to trigger it?
Today it runs on demand from the dashboard. It is not on a fixed background schedule, so build a habit (or a scheduled check on your side) of running it regularly rather than assuming it watches continuously in the background.
What channels can an alert go to?
A Slack or Discord incoming webhook, or any custom webhook endpoint you configure. There is no email delivery today.
See where this stands in your own setup
This page describes the mechanism. The 5 minute assessment scores your own attribution, enforcement, and reconciliation setup, so you know exactly which of these problems you actually have today.
Run the 5 minute assessment