What cost control forbids

Why can one control loop never be enough, and what does each escape cost the organization?

What this article forbids

A single cost-control loop. The speed and the accuracy requirements are incompatible, and you need both.
Attribution finer than isolation. That information no longer exists.
Retention policy without usage lineage.
Chargeback without anticipating that teams will optimize the number you gave them. They will do it competently and immediately.

The escapes and their prices

Every escape here is paid in an organizational currency and not a technical one, which is what makes this the part people skip.

Escape	Price
Cap it	false positives on legitimate large work (a good trade on a heavy tail, a bad one on a uniform distribution)
Isolate it	multiplexing loss: the same idle you were trying to eliminate
Charge for it	fragmentation and duplication
Delete it	an unbounded tail risk that no one wants to own

Case, resolvedConstructed case · Tomás at Brightloom

A 5-minute schedule, found 19 days later

An analyst changed a scheduled query from daily to every five minutes and nobody noticed for weeks, and Priya's new chargeback made one team duplicate a shared table to cut its own line. Where it started: Control and attribution →

He builds both loops.

Inner loop (fast). The query service now refuses any query whose dry-run estimate exceeds 1 TB unless a tag approved=true is set. A scheduled query is limited to a minimum interval of 1 hour, and any job with more than 3× its 7-day average daily spend triggers a notification the same day. Under that rule, the 5-minute query (288 runs a day, about 115 TB scanned per day) would have been stopped in the first day, and not on day 19.
Outer loop (slow). Every resource has team, pipeline and env tags. Each team has its own warehouse, so spend can be attributed (this loses some sharing efficiency, and he accepts it). The monthly review looks at $ per active shop and its trend, plus $ per GB ingested, two denominators with opposite biases.
Retention. Using access logs, he finds that 60% of derived tables have not been read in 90 days. With a clear owner for each one, he deletes or archives them.
Chargeback. Instead of billing teams for a shared table, the platform team pays for shared assets and allocates them by an agreed fixed rule. The private copy is retired.