FINANCE
Untagged spend leak detector → cost-center attribution → PagerDuty + ticket
Daily it finds cloud spend that lacks a cost-allocation tag, attributes the resources to a team using Axiom service logs.
How it runs
The automated pipeline, trigger to output.
- TriggerDaily schedule after cost export available
- ActionRead cost rows from S3 and isolate untagged spendAWS S3
- ActionQuery Axiom to infer owning team per untagged resourceAxiom
- LogicCheck whether untagged total crosses dollar threshold
- ActionPage finance on-call when over thresholdPagerDuty
- OutputOpen Linear cleanup ticket with inferred owners + impactLinear
What it does
This workflow hunts for the silent cost leak: resources running without a cost-allocation tag, so their spend can't be charged back to any team. It reads the cost export, isolates untagged spend, uses Axiom service logs to infer which team likely owns each untagged resource, and escalates when the untagged total crosses your threshold.
When to use it
Use it when chargeback accuracy is slipping because too much spend is untagged and nobody owns the cleanup. It catches tagging drift the same day it appears instead of at month-end reconciliation.
How it works
- 1A daily schedule runs after the cost export is available.
- 2It reads the cost-and-usage rows from S3 and isolates resources with no cost-center tag.
- 3It queries Axiom logs to infer the owning service or team per untagged resource.
- 4A threshold check evaluates whether total untagged spend warrants escalation.
- 5If over threshold, it pages the finance on-call via PagerDuty.
- 6It opens a Linear ticket listing untagged resources, inferred owners, and dollar impact.
Set it up
What you configure once, before turning it on.
- 1Connect AWS S3Buckets, objects, signed URLs.
- 2Connect AxiomLog streams, queries, dashboards.
- 3Connect PagerDutyIncidents, on-call, escalations.
- 4Connect LinearIssues, projects, cycles, triage.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Finance workflows
Expense Submission Webhook Instant Triage and Routing
Receives each expense submission via webhook the instant it's filed, classifies it as in-policy, needs-review, or hard-violation, and routes it to auto-approval.
Monthly Vendor Spend Anomaly Brief for Finance Leads
Once a month, an agent analyzes the full expense ledger for vendor and category spend anomalies, drafts a narrative brief with the top outliers and likely causes.
Accrual Chase Board in Monday with Per-Owner Tasks
On a schedule it reads open uncoded expenses from Snowflake and creates or updates a Monday item per department owner.
Detect Annual-to-Monthly Downgrade Refunds Owed
Catches subscriptions switched from an annual term to monthly partway through the prepaid year, computes the unused prepaid balance owed back.
Detect Mid-Cycle Plan Change Mischarges and Queue Credit Memos
Listens for Stripe subscription plan changes, recomputes the correct prorated amount.
Overdue Accrual Escalation Emails to Owners and Managers
On a schedule it flags uncoded spend that has stayed open past the chase deadline and emails each delinquent owner via Gmail.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.