If you run LLM/agent workflows, a prompt tweak or a model swap can quietly multiply per-run token cost, and you usually find out on the invoice. The pattern that’s worked for us: a CI check that measures token cost per run and flags a regression against a baseline — but gated in warn mode first (annotate the PR, never fail the build) so the team trusts the numbers before you turn on blocking.

Write-up covers what to measure, why warn-mode-first, and the failure modes.

Disclosure: I maintain the OSS tooling behind it (a CI cost-guardrail Action + tokenscope, Apache-2.0). Sharing mostly the warn-mode-first rollout pattern, which applies whatever tool you use — happy to answer setup questions.