Guardrails

The spend guardrails you can turn on today

Every major provider already gives you a way to cap spend, alert on a threshold, or flag a statistical anomaly. Most accounts have none of it turned on. This page lays out what each layer actually does, where every one of them stops, and a generator that writes the exact command to switch one on.

Generate a guardrail →See CostMon's own detection

Last updated August 23, 2026

The four layers

Only one of these actually stops money

Hard cap

The only layer that stops spend on its own.

A hard cap stops usage once spend crosses a number you set. It turns access off, instead of just telling someone about it.

AWS Budgets can run an action when a budget is exceeded. The action applies an IAM policy or a service control policy that denies further use, or targets specific EC2 or RDS instances, and it runs "either automatically or after your manual approval."

Anthropic has two separate versions of this. Claude Platform (Claude Console) organizations get a monthly spend cap tied to their usage tier: $500, $1,000, or $200,000. They can set their own cap below that in Settings > Billing, and once spend reaches the cap, API requests pause until the next calendar month. Claude Enterprise organizations instead use the Spend Limits API to cap spend per member.

OpenAI documents the same idea for its own API: hard spend limits "stop affected API traffic when tracked spend reaches the limit," set on the Limits page of an organization's settings.

Google Cloud and Azure don't offer this natively. A budget on either one only sends a notification. Turning that into an actual stop means building it yourself: on Google Cloud, a Pub/Sub message that triggers a function to disable billing; on Azure, an action group that triggers a Logic App or a Function.

Threshold alert

Free everywhere. You still have to guess the number.

A threshold alert notifies someone once spend, or forecast spend, crosses a percentage of a budget you set: 50%, 80%, 100%, whatever you pick.

AWS Budgets, Google Cloud budgets, and Azure Cost Management budgets all offer this, all evaluated daily, and all free to use.

The catch is the number itself. A threshold only works if you already know what normal spend looks like. Set it too low and it fires most weeks. Set it too high and it fires after the damage is already done. It also only watches the one total, or the one filtered slice, you configured it against. A service running away underneath that total stays invisible until the total itself moves.

Anomaly alert

No threshold to guess, where it exists.

An anomaly alert compares today's spend to your own recent history and flags what doesn't fit, instead of asking you to name a number in advance.

AWS Cost Anomaly Detection "uses machine learning models to detect and alert on anomalous spend patterns" and runs "approximately three times a day." Because it reads from Cost Explorer data, which carries its own delay, "it can take up to 24 hours to detect an anomaly after a usage occurs."

Azure Cost Management runs the same idea daily: cost anomalies are "evaluated for subscriptions daily" against "a forecasted total based on the last 60 days," using a deep-learning model, with detection running "36 hours after the end of the day (UTC) to ensure a complete data set is available." It is free and available to every subscription tracked in Cost Analysis.

Google Cloud has a cost anomaly detection feature too, currently in Preview. Its documentation describes the "Anomaly threshold" setting that gates which detected anomalies notify you: leaving it blank "sets the threshold to zero," so "notifications are sent for all anomalies." It doesn't document the detection method itself, so that part is left unstated here rather than guessed.

None of these look across providers. Each one only ever sees the spend inside its own account.

Unit economics watch

Not native to any provider.

None of the five providers on this page can tell you what one customer, one feature, or one request costs. Every guardrail above watches a total, a service, or a tag, never a unit of your own product.

This is the layer CostMon adds on top of the four above, not instead of them. Turn on the free guardrails first; add a cost-per-customer view for the number none of them can see. See the Cost Per Customer & Unit Economics Calculator for a starting estimate from your own numbers.

Free tool

The Guardrail Generator

Pick a provider, set a budget and a couple of thresholds, and get back the exact Terraform, gcloud command, or curl request to turn that guardrail on. Every field below stays in this page's JavaScript; nothing you type is sent anywhere.

ProviderAWSGoogle CloudAnthropic

Monthly budget (USD)Alert thresholds (% of budget, comma separated)Notify emailAlso create an AWS Cost Anomaly Detection monitor + subscription

Terraform — apply with terraform apply

resource "aws_budgets_budget" "monthly_guardrail" {
  name         = "costmon-monthly-guardrail"
  budget_type  = "COST"
  limit_amount = "5000"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 50
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["finance@example.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 50
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["finance@example.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["finance@example.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["finance@example.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["finance@example.com"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 100
    threshold_type             = "PERCENTAGE"
    notification_type          = "FORECASTED"
    subscriber_email_addresses = ["finance@example.com"]
  }
}

resource "aws_ce_anomaly_monitor" "all_services" {
  name              = "costmon-service-monitor"
  monitor_type      = "DIMENSIONAL"
  monitor_dimension = "SERVICE"
}

resource "aws_ce_anomaly_subscription" "alerts" {
  name             = "costmon-anomaly-alerts"
  frequency        = "DAILY"
  monitor_arn_list = [aws_ce_anomaly_monitor.all_services.arn]

  subscriber {
    type    = "EMAIL"
    address = "finance@example.com"
  }
}

A gcloud command, run once

# gcloud billing budgets create has no email flag: alerts go automatically
# to this billing account's Administrators and Users. To also notify
# 'finance@example.com', add them as a Billing Account User, or create a Cloud
# Monitoring notification channel and pass its ID with
# --notifications-rule-monitoring-notification-channels.
#
# A Google Cloud budget only sends a notification — it never caps spend on
# its own. See "Where native guardrails stop" on this page for what a real
# stop requires (a Pub/Sub-triggered function that disables billing).
gcloud billing budgets create \
  --billing-account=YOUR_BILLING_ACCOUNT_ID \
  --display-name='CostMon monthly guardrail' \
  --budget-amount='5000USD' \
  --threshold-rule=percent=0.50,basis=current-spend \
  --threshold-rule=percent=0.50,basis=forecasted-spend \
  --threshold-rule=percent=0.80,basis=current-spend \
  --threshold-rule=percent=0.80,basis=forecasted-spend \
  --threshold-rule=percent=1.00,basis=current-spend \
  --threshold-rule=percent=1.00,basis=forecasted-spend \

A curl request against the Spend Limits API

# Sets a per-member spend limit. Requires a Claude Enterprise organization
# and an Admin API key with the write:spend_limits scope — this API is not
# available to Claude Platform (Claude Console) organizations. Replace
# YOUR_USER_ID with the member's user ID.
#
# This endpoint has no notification field, so 'finance@example.com' is never sent to it.
# Claude Platform (Console) organizations set an org-wide spend cap instead,
# in Settings > Billing — see the provider matrix on this page.
curl --request POST "https://api.anthropic.com/v1/organizations/spend_limits" \
  --header "content-type: application/json" \
  --header "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  --data '{"scope": {"type": "user", "user_id": "YOUR_USER_ID"}, "amount": "500000"}'

This is a static site with no backend to send anything to. Open your browser's Network tab while you use this generator and you'll see nothing sent out.

Provider matrix

What's native, per provider

Checked against each provider's own documentation, current as of August 23, 2026. This moves; re-check the source before treating a row as current.

Provider support for a hard spend cap, alert grain and lag, cost, and cross-provider coverage
Provider	Can it hard-stop spend?	Alert grain & lag	Free?	Cross-provider?	Source
AWS	Yes — a Budgets action applying a Deny IAM policy or an SCP	Cost Explorer data, up to 24h lag; anomaly detection runs about 3x/day	Yes	No — AWS spend only	AWS Budgets actions →
Google Cloud	No — a budget only alerts; a real stop needs a Pub/Sub function that disables billing	Cost data typically same-day; anomaly detection is a Preview feature	Yes	No — Google Cloud spend only	Google Cloud budgets →
Azure	No — a budget notifies only; resources aren't affected and consumption isn't stopped	Cost data in 8–24h; anomaly alerts run daily with a 36-hour lag	Yes	No — Azure spend only	Azure Cost Management budgets →
Anthropic	Yes — an org-wide spend cap on Claude Platform (Console), or a per-member cap on Claude Enterprise	Enforced against tracked spend as it accrues	Yes for the cap itself; the per-member Spend Limits API needs Claude Enterprise	No — Anthropic spend only	Anthropic API spend limits →
OpenAI	Yes — a hard spend limit stops API traffic once tracked spend reaches it	Not documented in detail in the source cited here	Yes	No — OpenAI spend only	OpenAI production best practices →
SaaS & observability tools	No — most have no budget or spend-limit API at all	Varies by vendor; several offer no native cost alerting	Varies by vendor and plan	No	See CostMon's Datadog & warehouse cost guides →

Where native guardrails stop

The blind spots every one of these shares

One provider, one guardrail

Every guardrail above watches one provider's own spend. A hard cap on AWS does nothing if the runaway is happening in your Anthropic account. Seeing a cross-provider total means adding the providers up yourself, or watching a tool built to do that already.

Day-grain data, with the provider's own lag on top

None of these guardrails read a live, sub-day stream. Each one waits on its provider's own cost data, which lands with its own delay, then evaluates on its own schedule: daily for a budget, a few times a day at best for an anomaly detector. That's fast by invoice standards, but it isn't real time.

A threshold you have to guess

Every budget-based alert needs a number from you before it can do anything. Get it wrong and it either fires so often it gets ignored, or stays quiet long past the point where the spend was worth flagging.

Nothing per customer or per feature

A provider's own guardrails stop at the account, the service, or the tag. None of them can tell you that one customer, or one feature, is behind the number that tripped the alert.

A total-level budget can't see one service running away underneath it

A budget on your whole account, or even one service category, can stay under its own threshold while a single API key or a single feature quietly becomes most of the bill. The alert only fires once the total itself crosses the line. By then, whatever is driving it has already been running for a while.

How this maps to CostMon

What CostMon adds on top

What CostMon turns on for you, day one

Every new CostMon org gets one rule the moment someone first logs in: an org-wide, spend-only anomaly rule with a 14-day lookback, a 3.0 z-score threshold, a minimum 50% over baseline, and a $5 noise floor. It isn't one check against your account's total. It fans out to every (provider source, service) pair the org has cost data for, so a runaway on one service can't hide behind a healthy total the way a single account-level budget can.

A rule you create yourself can narrow that scope to one provider source, one service, or one tag. It can also watch a metric other than spend, such as tokens or requests per period, which surfaces an AI workload's usage pattern changing before the dollar figure catches up.

Turn these guardrails on first

None of this replaces the guardrails on this page. Turn on the hard cap and the anomaly detector your provider already gives you. They're free, and CostMon can't reach into AWS, Google Cloud, or Anthropic to press their stop button on your behalf.

CostMon's job starts where those guardrails stop: one normalized daily view across every provider source you connect, with the per-service breakdown a single provider's own total can't show.

Setup steps

How to turn each one on

AWS

Create the budget. Paste the generated Terraform into a .tf file and run terraform apply, or open Billing and Cost Management, select Budgets, and create one by hand with the same amount and thresholds.
Add the hard-stop action. Under Budgets, add a budget action that applies an IAM Deny policy or a service control policy once the budget is exceeded, and choose whether it runs automatically or waits for your approval.
Turn on Cost Anomaly Detection. Open Cost Anomaly Detection, create an AWS-managed monitor scoped to AWS services, and attach an alert subscription with the email addresses that should hear about it.

Google Cloud

Create the budget. Run the generated gcloud command, or open Billing, select Budgets & alerts, and create a budget with the same amount and threshold percentages.
Add who should hear about it. Budget alerts go to this billing account's Administrators and Users automatically. Add a teammate in that role to notify them, or create a Cloud Monitoring notification channel for anyone else.
Wire a real stop, if you need one. A Google Cloud budget only ever alerts. To actually stop spend, point the budget's Pub/Sub topic at a Cloud Function that disables billing on the project once it fires.

Anthropic

Set an org-wide cap (Claude Platform). In the Claude Console, open Settings > Billing, and set your own spend limit below your usage tier's cap. Requests pause once tracked spend reaches it, until the next calendar month.
Set a per-member cap (Claude Enterprise). Run the generated curl with an Admin API key that carries the write:spend_limits scope. Replace YOUR_USER_ID with the member's user ID.
Handle increase requests as they arrive. A member who hits their cap can request a higher one from claude.ai. Review and approve or deny each request from the Spend Limit Increase Requests API, or raise the cap directly.

Sources

Where every claim on this page comes from

Every provider capability named above is quoted from that provider's own documentation, current as of August 23, 2026. Anything we couldn't verify first-party is left off this page, not guessed.

AWS — Controlling your AWS costs with budget actions
States that budget actions' "available actions include applying an IAM policy or a service control policy (SCP)" and can target "specific Amazon EC2 or Amazon RDS instances," running "either automatically or after your manual approval." This is the only native AWS mechanism that stops spend rather than only alerting on it.
AWS — Detecting unusual spend with AWS Cost Anomaly Detection
States that Cost Anomaly Detection "uses machine learning models to detect and alert on anomalous spend patterns," runs "approximately three times a day," and that "it can take up to 24 hours to detect an anomaly after a usage occurs" because it depends on Cost Explorer data, which "has a delay of up to 24 hours."
HashiCorp (terraform-provider-aws) — aws_budgets_budget resource — argument reference
The resource's argument reference names budget_type, limit_amount, limit_unit, and time_unit as top-level arguments, and comparison_operator, threshold, threshold_type, notification_type, and subscriber_email_addresses as the notification block's arguments — the exact fields the AWS output on this page's generator fills in.
HashiCorp (terraform-provider-aws) — aws_ce_anomaly_monitor and aws_ce_anomaly_subscription — argument reference
aws_ce_anomaly_monitor's argument reference requires name and monitor_type ("DIMENSIONAL" or "CUSTOM") and, for a dimensional monitor, monitor_dimension. aws_ce_anomaly_subscription requires name, frequency ("DAILY", "IMMEDIATE", or "WEEKLY"), monitor_arn_list, and at least one subscriber block with type ("EMAIL" or "SNS") and address — the fields the optional anomaly-detection half of the AWS generator output fills in.
Google Cloud — gcloud billing budgets create — flag reference
Documents --billing-account, --display-name, --budget-amount, and --threshold-rule (with percent and basis=current-spend or forecasted-spend) as the command's core flags, and lists no flag for a notification email address — alerts route to the billing account's Administrators and Users unless you configure --notifications-rule-monitoring-notification-channels or --notifications-rule-pubsub-topic.
Google Cloud — Create, edit, or delete budgets and budget alerts
States, verbatim: "Setting an alerts-only budget doesn't automatically cap Google Cloud or Google Maps Platform usage or spending." A real stop needs a Pub/Sub notification wired to a function that disables billing on the project.
Google Cloud — Set up cost anomaly detection notifications
Documents cost anomaly detection as a Preview feature and states that an "Anomaly threshold" value "is the threshold value that triggers notifications," and that leaving it blank "sets the threshold to zero, and notifications are sent for all anomalies" — meaning anomalies are already being detected before any threshold is set. The page does not document the detection method itself.
Microsoft Learn — Tutorial: Create and manage budgets
States, verbatim: "Resources aren't affected, and your consumption isn't stopped." Cost and usage data is "typically available within 8-24 hours," and budgets "are evaluated against these costs every 24 hours." A budget can trigger an action group (email, a Logic App, a Function, a webhook), but the action itself is something you build, not something Azure does for you.
Microsoft Learn — Identify anomalies and unexpected changes in cost
States that "cost anomalies are evaluated for subscriptions daily" against "a forecasted total based on the last 60 days," that "anomaly detection runs 36 hours after the end of the day (UTC) to ensure a complete data set is available," and that the model is "a univariate time-series, unsupervised prediction, and reconstruction-based model" using the WaveNet deep-learning algorithm. Anomaly detection is "available to every subscription monitored using Cost Analysis," and "there's no charge to use Cost Management and Billing features."
Anthropic — Spend Limits API
States, verbatim: "The Spend Limits API is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations." Amounts are "strings in minor units of the organization's billing currency (cents, for USD)" — the example given is "50000" representing "500.00 USD." The create endpoint "accepts only scope.type: 'user'"; seat-tier, group, and organization-level defaults are set in claude.ai settings, not through this API.
Anthropic — Rate limits — Spend limits
States that "each of the Start, Build, and Scale tiers carries a monthly spend cap" of $500, $1,000, and $200,000 respectively, that "you can view your organization's monthly spend cap and set your own limit" on the Billing page, and that "once you reach your tier's spend cap, API usage pauses until 00:00 UTC on the first day of the next month." It also documents per-Workspace spend and rate limits, set separately from the organization limit.
OpenAI — Production best practices
States that "hard spend limits stop affected API traffic when tracked spend reaches the limit," set on the Limits page, and that a separate spend alert can "send notifications when usage exceeds a certain dollar amount."

FAQ

Common questions about spend guardrails

Which of these guardrails actually stops spend, not just alerts on it?

Only the hard cap does. AWS Budgets can apply a Deny policy or a service control policy once a budget is exceeded. Anthropic caps spend at the organization level on Claude Platform, or per member on Claude Enterprise. OpenAI's hard spend limit stops API traffic once tracked spend reaches it. Google Cloud and Azure budgets only ever notify. A real stop on either one means wiring your own automation on top.

Does the Guardrail Generator send my budget or email anywhere?

No. Every field stays in your browser. The generator builds the Terraform, gcloud command, or curl request entirely with JavaScript running on this page and never makes a network request with what you typed in. Open your browser's Network tab while you use it and you'll see nothing sent out.

Is Anthropic's Spend Limits API available to every Claude account?

No. Anthropic states plainly that "the Spend Limits API is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations." A Claude Platform organization instead sets an org-wide monthly spend cap in Settings > Billing, which is a real cap, just not this API and not per member.

Why doesn't a Google Cloud budget stop spend the way an AWS budget action can?

Google's own documentation says so directly: "Setting an alerts-only budget doesn't automatically cap Google Cloud or Google Maps Platform usage or spending." Reaching an actual stop takes an extra step Google doesn't build in: a Pub/Sub notification wired to a function that disables billing on the project.

How is CostMon's anomaly detection different from what AWS or Azure already do?

It isn't trying to be better at spotting one provider's own anomaly. AWS and Azure already run real statistical detection against their own data. CostMon's default rule fans out across every provider source you connect, so it's the one place a runaway shows up regardless of which provider it started on, alongside a normalized daily total none of the providers separately can produce.

Do I still need a threshold alert if I turn on anomaly detection?

Usually yes. An anomaly alert catches a spend pattern that breaks from your own history, but it can miss a slow, steady climb that never spikes hard enough to look anomalous. A threshold alert catches that instead, at the cost of needing a number from you. Most teams run both.

What does CostMon's seeded default rule actually watch?

An org-wide, spend-only rule with a 14-day lookback, a 3.0 z-score threshold, a minimum 50% over baseline, and a $5 noise floor. It fans out to every (provider source, service) pair in the org rather than checking one total, and it's there from the first login. There's nothing to configure before it's protecting the account.

The invoice is a lagging signal.

A monthly invoice tells you what already happened. CostMon builds a daily baseline, so a spike stands out while you can still act on it.

Start free See how budget alerts work