What decost is: policy, measurement and an invoice you can argue with

An organisation with four hundred developers on Claude Code and Codex receives an invoice each month with one line on it. No owner, no reason, no line items. The number goes up, someone asks why, and the honest answer is that nobody knows — not because the team is careless, but because the provider bills for HTTP requests and the question is about engineering work.

decost is the layer that turns that one line into an itemised bill, removes the part of it that bought nothing, and proves how much that was. This post is what it does, mechanically, and what it refuses to do.

The shape of the thing

Three components, and the order matters because each one exists to make the next one possible.

A gateway in your network. Every request from Claude Code and Codex passes through it on the way to Anthropic and OpenAI. It authenticates a per-developer credential, so the organisation’s provider key never reaches a laptop; it applies cost policy; and it records what each request actually cost. It is a single binary inside your own infrastructure, and request content is never written down.

A measurement engine. It reads that record and produces unit economics: cost per session, cost per thousand requests, tokens per request, cache hit rate, cost per active hour — broken down by team, developer, repository and model. Not a dashboard’s worth of charts, but the six numbers a platform lead can act on.

A report you can hand upward. Monthly, one page: what changed, decomposed into adoption, engagement and unit cost with no unexplained residual; the ledger of savings by policy; and a savings act with a place for a signature. That last artefact is the point of the other two.

What the policies actually do

The levers that move an agentic bill are few, mechanical and mostly configuration rather than engineering. We wrote up Uber’s public account of applying them at scale and the anatomy of a session’s bill; the short version is that four defaults carry most of the money.

Subagent traffic on a cheaper model. A subagent searching a file tree is doing scoped, mechanical work. Running it on the frontier model is paying the top rate for the least reasoning-dense traffic in the system, and in fleets that have adopted agent teams that traffic can be most of the bill.

Cache lifetime matched to how people actually work. The prompt cache is where the money hides. A read costs a tenth of the input rate; a prefix rebuilt after the cache expired costs full price to re-read plus a premium to write again. Interactive development is full of gaps longer than five minutes, and five minutes is the default lifetime on an API key. Extending it where developers actually idle removes a whole class of rebuild — and, because a one-hour write costs more than a five-minute one, extending it where they do not idle is a waste we do not recommend.

Tool definitions kept out of the prefix. Schemas preloaded into context are re-sent on every turn of every session, before the developer has typed anything.

Caps that stop rather than warn. Per-developer and per-team budgets, calendar-aligned, soft by default: the developer sees the remaining budget in their own terminal rather than discovering it as a failure. Hard caps exist and are the customer’s explicit decision, not our default.

Every policy is written in one reviewed file, applied fleet-wide, and visible: overrides are recorded rather than forbidden.

What “developers change nothing” means

One command per machine points both harnesses at the gateway, and after that the tools behave exactly as before. That is a design constraint with teeth, and it produces two properties worth stating plainly.

Request bytes are forwarded unchanged. Anthropic’s prompt cache matches on the exact serialised prefix, so a gateway that parses a request and re-serialises it can invalidate caches it never meant to touch. The symptom would not be an error; it would be a quietly lower cache hit rate and a quietly higher invoice. We forward the bytes. Where a policy has to change something, it changes that and nothing else. This is also why new provider features work through us on the day they ship rather than the day we add support.

Failure degrades toward passing traffic through. If any part of our layer fails, the request goes to the provider untouched and we lose the measurement for it. Losing a row of a spend log costs a rounding error in a monthly report; breaking an engineer’s session costs their afternoon. We sit on the critical path of someone else’s working day, and that asymmetry decides every failure mode we have.

Attribution: who spent it, and on what

The provider sees an HTTP request. It cannot tell you which team made it, which repository it was for, or which pull request came out of it — and the per-user attribution paths Anthropic documents all stop at the person.

Virtual keys replace the shared organisation key, so spend attributes to a developer, a team, a session and a subagent, and offboarding someone is one config line rather than a key rotation. Repository and branch come from the harnesses’ own local logs, joined to spend by the request id — the one identifier both sides record. That join is what turns a bill into a sentence like “the payments API cost $2,722 in agent time this month”, which is the first number an engineering leader has ever been able to say out loud about this spend.

Where the join is partial, the report prints the match rate next to the figure. Partial coverage that reads as full coverage is how measurement systems lose their credibility, and it takes one line to prevent.

How the savings are proved

This is the part that decides whether any of the rest is worth buying, because we charge a share of the savings and that is exactly the incentive to inflate them. So the method is fixed in the code rather than in a slide, and it has four properties.

Per-request counterfactuals at a fixed model. When a policy routes a request to a cheaper model, we price the same usage under the model the request originally asked for and count only the difference. Spend that falls because work moved to a weaker model is a substitution, not a saving, and a comparison that lets the model mix drift can manufacture any number in either direction.

Coverage is printed, not assumed. A before-and-after comparison is only as good as the share of traffic present in both periods. The report shows that share and lists what was excluded.

The estimate errs downward. Every measurement has failure modes: an unknown model, a missing price, a request that cannot be matched. Each one counts as zero saved. The reported figure is a floor, not an estimate — the direction of the error is a design decision, and it is the only direction that lets a finance team accept the number.

Volume is separated from unit cost. Total spend moves when headcount and adoption move. The claim worth making is that cost per unit of work fell while usage grew, which is what the decomposition on the report shows, term by term, summing exactly to the observed delta.

We wrote separately about why the vendor’s own per-developer figure is not a baseline, and the same discipline applies to our own reporting.

What you keep

The spend log is a plain newline-delimited JSON file in your infrastructure, with a FOCUS-format export for your FinOps stack. The dashboard and the report are rendered from it, and both recompute from the raw log on every refresh — there is no cached number anywhere that a report cannot reproduce.

If you stop working with us, the record stays yours and remains readable without us. That is not generosity; it is the condition under which a measurement vendor can be trusted at all.

What it costs

A pilot from $10K, credited back if we miss the savings threshold. A platform fee from $2K a month. Then a share of verified savings — capped, and sunsetting into a flat annual contract, because a success fee that never ends stops being aligned and starts being rent.

No savings, no fee. The arithmetic we quote is the one on the landing page: spend $100K a month, save $30K, keep $22K.

What decost is not

It is not a multi-provider router. Our customers are on two harnesses talking to two providers, and the general-purpose gateway features — semantic caching, prompt management, evaluation hooks, routing across a dozen vendors — are surface we would carry without using.

It is not an evaluation platform. Whether an agent produced good code is a real and separate question, answered by a different category of tool, and conflating the two is how cost programmes end up measuring neither.

It is not an autonomous optimiser. Every policy is a decision someone made, visible in one file, reversible in one line, with its dollar effect measured after the fact. We are not asking anyone to trust a system that changes their engineers’ tooling on its own judgement.

And it is not a dashboard that tells you your spend went up. That number you already have.

Frequently asked

Do developers have to change how they work? No. One command points Claude Code and Codex at the gateway; after that the tools behave as before, including new provider features on the day they ship, because request bytes are forwarded rather than translated.

What happens if the gateway goes down? Traffic passes through untouched and measurement stops for that period. Every failure mode degrades toward forwarding the request, and a one-line environment change points the harnesses straight back at the provider.

Does anything about our code or prompts leave our network? No. The gateway runs in your infrastructure, request content is never logged, and the spend record — tokens, model, cost, identifiers — stays in a file you own.

How is a saving distinguished from just using a cheaper model? By pricing the identical usage under the model the request originally asked for and counting only the difference, with the model mix held constant in every comparison. Substitution and removed waste are different things and the report keeps them apart.

How long before there are numbers? The baseline is reconstructed retrospectively from your provider’s billing history rather than waiting thirty days, so the first comparison arrives in the first week and the measured window runs from there.

What if we already have an LLM gateway? Then the question is whether it forwards bytes unchanged, what it does when it fails, and whether its numbers can be reconciled with an invoice request by request. We wrote the five questions as a way to ask that of any candidate, including us.