How to run an agent spend audit in 30 minutes

You don't need a dashboard project to audit agent spend. You need the audit log and 30 minutes. Here's the agenda — the same one from the weekly review template, compressed.

Question 1: where is the spend?

Group the log by agent, then by merchant. The shape tells you everything: one agent dominating, or a long tail of vendors you don't recognize.

Question 2: what got blocked that shouldn't have?

Blocked attempts are the firewall working — but blocks on legitimate work are the tuning signal. If a real workflow keeps hitting a cap, the cap is wrong, not the workflow.

Question 3: what got flagged?

Flagged transactions that were all approved mean your threshold is too low — you're paying humans to rubber-stamp. All denied means the agents are trying things they shouldn't.

The output

One rule change, measured next week. That's the whole audit: read the guide →