The Governance Discount

In June 2026, Uber, a company that prices rides by the second, capped its own engineers at $1,500 a month for agentic coding tools, after burning through its annual AI budget in roughly four months (Bloomberg; TechCrunch, 2026). A few weeks earlier, Microsoft had begun canceling most of its internal Claude Code licenses because token consumption ran far ahead of budget, and engineers were pointed at its own GitHub Copilot CLI instead (Fortune, 2026).

Hold those two together. The company that prices rides by the second could not keep its agent spend inside a budget. The company that sells AI by the token could not carry its own consumption. Neither is a story about weak models. The models did what they were asked, call after call. Both companies hit the absence of a boundary, and both reached for the after-the-fact version of governance, caps and cancellations: what you grab when the architecture shipped without any.

The problem is acquiring an offensive form. At CCS 2026, security researchers showed that a short adversarial prompt can push a reasoning model into tens of thousands of reasoning tokens on command, an attack class carrying the best name in the literature: denial of wallet (Liu et al., CCS 2026). Sit with that one. Runaway spend is no longer just an operational risk. It is something an adversary can do to you, on purpose, with a paragraph.

None of this is fringe. When Gartner forecast that over 40% of agentic AI projects would be canceled by the end of 2027, escalating costs led the cited reasons (Gartner, 2025). KPMG has US enterprises above a billion in revenue averaging $207 million in AI budgets over the next twelve months (KPMG, 2026). At those denominations, "the agents spent more than we expected" stops being an anecdote and becomes a variance the board asks about by name.

The wrong diagnosis

The consensus explanation is that models are too expensive. Wait for prices to fall. Route to smaller models. All reasonable, and all beside the point, because per-token prices have been falling the entire time the bills have been rising. When the unit price drops and the total climbs, the problem is not the unit price. The problem is the units.

Ungoverned agents are not expensive because models cost too much. They are expensive because nobody bounded the work.

The genre's most famous story, an agent loop that supposedly ran for eleven days and billed $47,000, circulates without a named company attached, so I will not hand it to you as fact. I do not need to. Build it as a hypothetical instead. Say a loop runs for eleven days because nothing in the architecture owns the question of whether it should still be running, and say the bill lands at $47,000. Nothing malfunctions. The model answers every call, the loop loops, which is the only job a loop has, and every step is cheap, reasonable, and billed accurately. Now cut the token price in half: the same incident costs $23,500, a fifty percent discount on eleven days of nothing. The parameter that mattered was never the rate. It was the eleven days. The bill is not the price of a failure. It is the price of an architecture with no opinion about when work should stop.

Which brings me to the claim this paper exists to make. Every mechanism in a governed agent org that exists to control the work also, as a structural side effect, makes the work cheaper. Not safer at a premium. Cheaper.

Governance is not a tax on autonomous work. It is the discount on it.

That sentence cuts against every instinct procurement has, because governance gets filed under overhead, next to compliance. So I will not argue it as an assertion. I will walk it, mechanism by mechanism, and you can price each one twice: once as a control, once as a discount.

Where the money actually goes

First, the waste map, because you cannot subtract what you have not itemized. Trace where an ungoverned deployment's spend concentrates and it is almost never the productive reasoning. It is a short list of habits, and every one of them is a missing boundary.

Context hauling: the agent carries everything anyone thought it might someday need into every call, and pays to re-read the pile each time. Scope discovery at execution prices: the agent decides what the job is while doing the job, and bills you for both, on every attempt. Retries from zero: a failure at the ninth step repurchases the first eight. Re-derivation: the fourth agent to touch a task rebuilds the understanding the first three already paid for. Scheduled busywork: polls, re-scans, and re-summarizations that run because it is 9 AM, not because anything changed. And late discovery: pathological paths that run until a human reads a statement.

Notice what is missing from that list: the model being wrong. Waste in agent systems is mostly not an intelligence problem. It is a boundary problem, six different ways. Now the walk.

Scoped roles: stop paying for luggage

In a governed agent org, every agent is a seat with a defined role, and each seat carries only its domain context: its responsibilities, its escalation paths, its slice of the world. That design exists for governance reasons. A role you can describe is a role you can bound, review, and hold to account.

The efficiency reading is blunter. Tokens are the unit of billing, and context is tokens. An ungoverned agent walks into every task dragging the entire company behind it, and you pay freight on that load every single call, thousands of calls a day. Scope the seat and the freight drops to what the job needs. Most of what an unscoped deployment buys is not reasoning. It is luggage.

The Brief: the deciding happens before the spending

Every piece of work in a governed org begins as a Brief: a written scope with acceptance criteria and a cost band, ratified by a human before any agent moves. The Calibrated Brief covers the mechanism in full. The governance purpose is obvious, since nothing should run without an accountable yes.

The efficiency purpose hides in plain sight. The most expensive phase of ungoverned agent work is figuring out what the work is, because that exploration happens at execution prices, again on every attempt. Scope churn is the silent line item: attempt, discover the real requirement, restart, re-explore. The Brief does the deciding once, in one bounded place, and pins a number to it before anything runs. Execution starts from a settled question, and settled questions do not bill by the day.

Caps: a bad path dies young

Hard spend caps sit in the execution path, checked before a model call is made, and a tripped cap halts the agent that tripped it. When the Agent Spends Money walks the full spend architecture and makes the control argument.

Here is the discount argument. A cap converts worst-case cost from a discovery into a decision. In an ungoverned system, the ceiling on a pathological path is whenever a human notices, which is how eleven days happens. In a governed org the same failure dies in minutes, at a ceiling somebody chose in advance, and produces a report instead of an incident. Same defect, different denomination. The failure is not prevented. It is repriced.

Artifacts: never buy the same thought twice

Handoffs between agents are files on disk. A spec, a review, an implementation artifact: the downstream agent reads the artifact and produces its own, rather than re-deriving what the upstream agent already established. Files, Not Memories makes the architectural case, and the audit case is self-evident, since an artifact can be inspected and a conversation cannot.

The cost case may be the strongest of the three. Re-derivation is the silent multiplier of multi-agent systems. Let several agents touch one task without artifacts and each rebuilds its understanding from zero, so you purchase the same comprehension over and over, at retail. Artifact handoffs mean a conclusion is paid for once and read forever, and reading is nearly free.

The expensive thing is not the thinking. It is paying for the same thinking twice.

Change-driven execution: the run that never fires

In a governed org, execution is change-driven. Nothing runs when nothing changed. That sounds like an engineering nicety until you audit an ungoverned fleet and find the schedule doing the spending: re-scanning unchanged repositories, re-summarizing unchanged documents, polling on the hour because a schedule is easier to build than a boundary. That habit is an industrial process for converting idle time into billable events.

The cheapest model call is the one that never happens.

No optimization beats not running. A discount can lower a price; only a boundary can delete it.

Replay: resume, do not redo

Work fails. In a governed org, failed work lands in a dead-letter queue with its state intact, and replay resumes from the failed step. The governance value: a failure is a record, not a mystery, and nothing silently vanishes.

The efficiency value is arithmetic. The ungoverned alternative is retry-from-zero: to reach the failure at step nine, repurchase steps one through eight, and again on the next attempt. Replay bills you for the step that failed, not for the whole trip back to it. Across a month of operation, the difference between resume and redo is a multiple on every failure you have.

Self-checks: weirdness flagged while it is cheap

The org continuously tests itself: anomaly detection over its own behavior, synthetic checks that exercise the pipeline and flag drift. Governance reading: a system that reports its own weirdness is a system you can supervise.

Cost reading: an anomaly flagged in minute five costs minutes. The identical anomaly discovered on a monthly statement costs a month, plus the reconstruction. Early detection is not a quality feature that happens to touch cost. In an autonomous system billed per action, early detection is a price.

Yes, the gates add steps

Now the honest part, because the argument does not survive without it. Every mechanism above adds something: a ratification, a check, a queue, a file written to disk. A governed change passes through more steps than an ungoverned one, and any single gate, priced in isolation, is pure overhead.

The system is a different object than the gate. A gate costs seconds and cents. The failures the gates delete cost days and thousands, and they compound, because an unbounded failure spends until something external stops it. Steps are linear and cheap. Waste is compounding and expensive. The governed org trades a handful of the first to delete whole categories of the second, and the trade is not close. The structure does not economize by moving faster through the work. It economizes by removing the work that should never have existed: the luggage, the re-derivation, the restarts, the busywork, the loop's tenth day.

This argument has been settled once already

Manufacturing had exactly this fight in the twentieth century, and it ended in a rout. Philip Crosby spent the late seventies insisting that quality programs were not a cost center, because prevention is cheaper than failure, and he put the claim on the cover: Quality Is Free (Crosby, 1979). The factories that believed him stopped treating inspection discipline as a tax and started pricing scrap, rework, and recalls next to it, and the arithmetic was not a contest. A generation earlier, Taiichi Ohno built the Toyota Production System on the same inversion and named overproduction, making things nobody asked for, as the worst of the wastes (Ohno, 1988). The discipline that looked like constraint from outside the plant was the cost structure inside it. The factories with the most gates became the cheapest producers on earth, and nobody today calls the Toyota Production System a tax on carmaking.

The agent industry is standing at the start of the same lesson with compute. It is pricing discipline as a luxury while paying, invoice after invoice, for scrap.

The number I will not make up

I run SpeyAI on the agent org it sells, so the expected next move is a big claimed percentage: our structure cuts agent spend by some impressive figure. I am not going to type a number invented for this paragraph. Part of that is discipline. Part of it is measurement honesty: the ungoverned baseline cannot be priced by construction, because nobody runs the same month of work both ways, and the ungoverned side keeps no ledger capable of settling the bet. Treat any vendor quoting a precise savings percentage against ungoverned agents as quoting a number nobody measured. Where a real, ledger-derived figure belongs, it comes from our instance's own records: at this writing, $1.44 per shipped change.

What I can hand you is the shape, because the shape is auditable in anyone's architecture. Work bounded before it starts. Capped while it runs. Resumed instead of redone. Priced after it ships. Every term in that sentence is a governance mechanism. Every term is also a subtraction from the bill.

The sign is backwards

What a Shipped Change Costs, this paper's sibling, argued that a governed agent org can put a price on one unit of outcome. This paper's claim is one step ruder: the same structure lowers the price it prints. Together they close the loop the market keeps leaving open, a system that can state what the work costs and a design that makes the stated number small.

Buyers still evaluate governance the way they evaluate insurance: necessary, dull, priced as pure cost. The public record of 2026 reads the other way. The deployments being capped, canceled, and clawed back are the ungoverned ones, and the reason on the docket is cost. The expensive option was the one without the structure.

So when the governance conversation starts inside your organization, and someone asks what the control layer is going to cost, the honest answer points in the opposite direction from the question. The market prices governance as overhead. The ledger prices it as the discount.

The takeaway: Runaway agent spend is a boundary problem misdiagnosed as a pricing problem. The public record, per-engineer spending caps at Uber, canceled Claude Code licenses at Microsoft, adversarial prompts that burn reasoning tokens on command, is what architecture without boundaries bills like. In a governed agent org, every control doubles as a discount: scoped roles cut the tokens hauled into every call, the Brief settles scope before the spending starts, execution-path caps make a bad path die in minutes at a chosen ceiling, artifact handoffs mean a conclusion is bought once, change-driven execution deletes the runs nothing needed, and replay resumes failed work instead of repurchasing it. Any single gate is a step. The system is a subtraction. Governance is not a tax on autonomous work. It is the discount on it.

References

1. SpeyAI agent org architecture. Live reference at speyai.com. Scoped seats with per-role domain context, Briefs carrying cost bands ratified before work begins, hard spend caps enforced in the execution path, artifact-based handoffs, change-driven execution, dead-letter queue with replay, anomaly detection and synthetic self-checks.

2. Gartner. (2025, June 25). Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. Press release citing escalating costs, unclear business value, and inadequate risk controls as the primary failure modes.

3. KPMG. (2026). AI Pulse Survey, Q1 2026. US enterprises above $1 billion in revenue averaging $207 million in AI budgets over the next twelve months.

4. Crosby, P. B. (1979). Quality Is Free: The Art of Making Quality Certain. McGraw-Hill. The argument that prevention costs less than failure, and that quality programs are self-funding.

5. Ohno, T. (1988). Toyota Production System: Beyond Large-Scale Production. Productivity Press. Names overproduction as the most damaging of the seven wastes.

6. Bloomberg. (2026, June 2). Uber Caps Employee Spending on AI Tools Like Claude Code to Manage Costs. Also TechCrunch (2026, June 2), Uber caps employee AI spending after blowing through budget in four months. Uber capped employees at $1,500 per month, per agentic coding tool (Claude Code, Cursor), after running through its annual AI budget in roughly four months; caps can be exceeded with permission. Originally reported by The Information.

7. Fortune. (2026, May 22). Microsoft reports are exposing AI's real cost problem. Reports, crediting The Verge, that Microsoft began canceling most of its internal Claude Code licenses roughly six months after rollout as token-based consumption ran far ahead of budget, redirecting engineers to its own GitHub Copilot CLI.

8. Liu, X., Wang, X., Zhang, Y., Kariyappa, S., Xiang, C., Chen, M., Suh, G. E., and Xiao, C. (2026). ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models. ACM CCS 2026; arXiv:2602.00154. Short adversarial prompts induce 19,263 reasoning tokens on average across the reasoning models tested, a metered-API cost attack described as denial of wallet. (The denial-of-wallet term predates this paper in the cloud-security literature; the body's "best name in the literature" phrasing is accurate as written.)

This paper is part of Rise of the Agent Org, a series by Ed Hoehn, SpeyAI. The full library is at speyai.com/record.