Lesson 89.1 protected quality as volume grows. Now protect the money — because scale's costs rarely arrive as one big bill. They arrive as pennies per run, per thousand tokens, per task, per seat, compounding while everyone watches the quality dashboard. By the time finance notices, the margin is gone and the workflow is "too embedded to stop."

The vocabulary, in plain language

• Fixed cost: what you pay regardless of volume — a platform seat, a server. Predictable, but wasteful if the workflow dies.
• Variable cost: what grows with every run — model tokens, per-task fees, API calls, email sends. This is where scale bites.
• Unit cost: variable cost per completed job — "43 cents per triaged ticket." The number that lets you compare workflows and price offers.
• Budget cap: the hard ceiling — spend stops (or needs approval) past this line. A cap without enforcement is a wish.
• Alert: the early warning at 50%, 80% of cap — routed to the owner while there's still time to act.
• Rate limit: throttling how fast spend can happen — max runs per hour/day, max tokens per job. Limits turn a runaway loop into a bounded incident.
• Vendor concentration: dependence on one provider for most of a critical flow — one price rise or outage away from pain.
• Kill switch: the documented way to stop spend immediately — who pulls it, where, what breaks safely. (Lesson 88.4 introduced the operational stop; this is its financial twin.)

The mental model: a water meter with shutoff valves. You read usage per appliance (unit cost), set warning levels (alerts), cap the main (budget cap), fit flow restrictors (rate limits), avoid single-source plumbing (concentration), and every adult in the house knows where the shutoff is (kill switch).

Where the money hides

Three cost families, each with its own tripwire:

• Model costs — tokens in/out per job × runs. Watch prompt bloat (ever-longer retrieved context), retry storms re-calling the model, and oversized models for trivial classification. Cap tokens per job; log per-run usage.
• API / platform costs — per-task or per-operation pricing (Zapier help, Make help), per-seat automation platforms (n8n docs for self-host vs. cloud trade-offs), CRM overage tiers (HubSpot knowledge base). Price at 10× volume before committing (Lesson 88.2).
• Infra costs — servers, queues, storage, webhook endpoints, log retention. Small per unit, permanent over time. Include them in unit cost or they'll be "free" until the invoice.

Add per-workflow caps (this flow may spend $X/month), monthly vendor totals (all flows on one vendor ≤ $Y), and concentration notes (no critical flow solely on one vendor without a fallback sketch).

Exercise: set the guardrails

Create SCALE-COST-GUARDRAILS.md:

# SCALE-COST-GUARDRAILS.md — [Operation] — [Month]

## Unit costs (measured, not guessed)
- Workflow ___: $___ per completed job (model $___ + platform/API $___ + infra $___)
- Source of numbers: ___ (logs/billing page, date ___)

## Caps + alerts
- Per-workflow cap: $___/mo → alert at 50/80% to ___ → action ___
- Monthly vendor totals: ___ ≤ $___ (owner ___)
- Hard stop: spend past $___ requires ___ approval / auto-pause ___

## Rate limits
- Max runs/hr ___ / max tokens/job ___ / max retries/job ___ (Lesson 88.4)

## Concentration
- Critical flows on single vendor: ___ / fallback sketch: ___

## Kill switch
- Location ___ / who may pull ___ / safe-stop behavior ___ / resume requires ___
- Last tested: ___

Worked mini-example — support triage at 1,000 tickets/month: unit cost $0.41 (model $0.22 + platform $0.15 + infra $0.04). Per-workflow cap $500/mo, alerts to the ops owner. Rate limit 100 runs/hr stops a loop from burning the cap overnight. Kill switch tested quarterly — pausing the scenario leaves tickets queued, never deleted. When a prompt change doubled token use, the 50% alert caught it in week two, not at month-end.

Finish line: guardrails with measured unit costs, caps, alerts, rate limits, a concentration note, and a tested kill switch.

Verify quickly: multiply unit cost by 10× volume. If the result shocks you, the cap is wrong or the design is. Then confirm the kill switch works — pull it in test and watch spend stop.

Common failure mode: the free-trial architecture — built on trial credits and the cheapest tier, unit cost unknown, no alerts, kill switch "we'll figure it out." It works until the first real invoice, which arrives the same week as the first outage.

Check your understanding

1. Why must unit cost include all three families — what happens if infra is left out? 2. What turns a budget cap from a wish into a control? 3. How do rate limits bound the damage from a runaway retry loop?

Next

Money is guarded. Now the operation must survive your absence — Lesson 89.3 writes the one-page runbook that lets someone else (or future you) run, fix, and stop the top workflow.