Per-turn model usage on the wire, so a Guardian can enforce cost ceilings (LLM06 Unbounded Consumption)

[arsentev-ai]

The gap. A Guardian can gate tool calls and see turns, compaction and subagents, but no hook payload says how much model inference a turn consumed. turnEnd carries step_count and tool_call_count, sessionEnd.summary carries outcome, step_count and errors, and the only token figure on the wire is preCompact.estimated_input_tokens. A Guardian therefore cannot enforce the per-run cost ceilings recommended by OWASP LLM06:2026 Unbounded Consumption (Mitigation #9, Agentic Circuit Breakers). It also cannot see LLM06 Scenario #8 (growing context in agentic sessions), where every request stays within limits and only the accumulated total is the problem.

Why step counts are not a proxy. Measured on 722 coding-agent sessions (150,902 model calls, 34.6B tokens), processing the context was 83.5% of modelled cost and generation was 16.5%. On 168 other sessions, 94.4% of billed tokens were re-reads of context already sent. The cost of a step depends on how much context has accumulated, so two turns with the same step_count can differ by orders of magnitude. Cost is also concentrated: 3.3% of sessions produced 80% of cost, and sessions longer than 200 model calls were 8% of sessions and 92.2% of cost. These are the sessions a ceiling exists for.

Principle 3 case. The host sees provider usage on every model response, but that information is lost for ACS purposes. Provider billing is aggregated per API key or project, not per ACS session_id, turn_id or subagent, and it is not available until after the fact. That is too late for a ceiling that has to stop the next step. The Guardian cannot estimate usage either, since it never sees the assembled prompt (the gap raised in #122).

Sketch (for discussion, not a PR). An optional, host-reported usage object on turnEnd, with model_calls plus token counts named after the OpenTelemetry GenAI conventions rather than new names (input_tokens, cache_read_input_tokens, output_tokens, mapped to gen_ai.usage.input_tokens, gen_ai.usage.cache_read.input_tokens, gen_ai.usage.output_tokens in otel-mapping.json). Optional cumulative totals would go in sessionEnd.summary and subagentStop. The object stays audit-only with no new MUST. Acting on the totals, such as denying at the next turnStart or toolCallRequest, remains policy and off the wire.

Alternatives considered. (1) Leave usage to OTel traces alone. This works for dashboards, but the Guardian in the decision path does not consume traces. (2) policy_data carries Guardian intent toward the agent, not host-reported telemetry. (3) A "cost accounting" conformance profile instead of Core, which may be the right altitude. (4) Prior art on a per-run resource record: IETF Internet-Draft draft-arsentev-agent-run-metrics.

Scope. Honestly this is deferred work under the current priority scope. I am raising it so it can be tracked. Disclosure: I wrote the reports and the draft cited here.

Sources: https://arsentev.ai/research/context-economy-of-agentic-llm-sessions (DOI 10.5281/zenodo.22688706, technical report, not peer reviewed); contextburn, MIT, https://github.com/arsentev-ai/contextburn (DOI 10.5281/zenodo.22712985); https://datatracker.ietf.org/doc/draft-arsentev-agent-run-metrics/ ; LLM06:2026 https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM06_UnboundedConsumption.md