Skip to content

Budgets & alerts

Use this guide to set a budget over attributed spend; configure the 75% / 100% / 150% thresholds; choose delivery channels; and control alert volume. Budget governance runs in Advisory (Shape) by default. Optional enforcement through Active (Gate) is explicit and customer-controlled, while the decision-time interceptor remains fail-open.

Setting a budget

A budget is a spend limit for a scope you choose (a team, a project, a cost center, or the whole organization) over a time period. Budgets are configured in the Governance surface (Cost / Governance) by users with the FinOps or Admin role, and they measure against attributed spend, so the figure a budget tracks is the same figure that appears on your dashboard.

The spend a budget measures

A budget tracks period-to-date attributed spend for its scope, built from two cost fields that Venturi keeps separate:

  • Estimated cost is computed from tokens and pricing within seconds of each invocation and is labeled estimated.
  • Reconciled cost replaces the estimate once reconciliation has trued it up against the provider’s billing data, which targets completion within 24 hours (see Reconciliation).

The budget figure uses the reconciled cost wherever reconciliation has completed and the labeled estimate everywhere else. Threshold states, alerts, and the Active (Gate) signed deny recommendation described below are all evaluated on that same figure as it updates, so they do not wait for reconciliation. Until reconciliation completes, the figure carries the same estimated label it carries on the dashboard.

Larger budget changes are subject to approval thresholds: raising a budget above a configured value escalates from a single approver to dual approval, and the change is recorded in the audit log.

Threshold alerts

Each budget raises alerts as consumption climbs toward and past its limit:

Threshold Meaning
75% Approaching plan: early warning to investigate.
100% At plan: the budget is fully consumed.
150% Materially over plan: an overrun that warrants action.

Threshold events appear in the Governance view as the budget figure crosses each threshold and feed both real-time alerts and periodic digests. A budget-threshold digest lists each breach with a deep link to triage, and the rows in the digest always match the live Governance view.

Advisory (Shape) by default, Active (Gate) by choice

Budgets run in Advisory (Shape) by default

Out of the box, budget governance runs in Advisory (Shape): it alerts and reports, but does not stop anything. Where you want a budget to stop spend, an Admin can enable Active (Gate) for a named workload that the budget covers, once that workload’s trust readiness reaches OPERATIONALLY_TRUSTED. When the budget reaches its configured threshold, Venturi emits a signed deny recommendation for that workload, and your customer-controlled enforcement point (your gateway, proxy policy, or budget control) decides whether to apply it. The recommendation reaches your enforcement point through the Active (Gate) enforcement integration you set up when you enable it; its delivery endpoint, payload fields, and signature verification key belong to that integration, not to the webhook event catalog. The decision-time interceptor remains fail-open: Venturi never turns a recommendation into an in-proxy denial.

This keeps the FinOps guardrail useful without ever making Venturi a single point of failure in front of your AI.

Forecasting

Venturi forecasts spend so a breach is something you anticipate, not discover. Using attributed trends, Forecasting (Cost / Forecasting, also reachable from the Capacity domain) projects where each budget is heading over 30-, 60-, and 90-day horizons, supports scenario modeling, and flags the budgets expected to breach before period end. Each projection carries confidence bands, so finance can see how uncertain a forecast is before planning against it.

This turns the governance question from “did we overspend?” into “which budgets will breach, and what do we do now?”

Where alerts go

Route alerts to the channels your team already uses. Delivery preferences form a matrix of notification type, channel, and severity. An Admin sets organization defaults under Settings / Admin / Notifications; each user can narrow those defaults but cannot widen them beyond policy, and critical security and residency alerts cannot be disabled below the policy floor. Quiet hours suppress non-critical notifications in the user’s local time zone. Real-time notifications for critical events target delivery at P95 ≤ 30 seconds from event detection in-app, in Slack, and in Microsoft Teams; digests deliver within their digest window. A missed delivery raises an alarm instead of being dropped silently.

Alerts appear in the in-app notification center and, per preference, by email. Email supports per-event or digest delivery and locale-aware formatting.

Route threshold and anomaly alerts to specific Slack or Microsoft Teams channels with the same routing rules. Both channels carry a deep link and support acknowledgment; acknowledging in either channel marks the in-app item acknowledged and records who did it. High-severity alerts also support inline assignment from either channel.

Register an outbound HTTPS endpoint to receive alerts as signed payloads (Venturi-Signature header) so you can drive your own automation. Failed deliveries retry with exponential backoff for up to roughly 24 hours before they are dead-lettered, and you can replay any event from the delivery log. Registering an endpoint and replaying deliveries both require the webhooks:manage scope. See Webhooks for the retry schedule, signature verification, and delivery log.

JSON
{
  "id": "evt_01J8Z3K7Q9M2V4T6X8B0C2D4F6",
  "type": "budget.threshold.crossed",
  "created_at": "2026-05-28T14:02:11Z",
  "tenant_id": "tnt_01J8Z3K7Q9M2V4T6X8B0C2D4F7",
  "sequence": 48213,
  "data": {
    "budget_id": "bdg_01J8Z3K7Q9M2V4T6X8B0C2D4F8",
    "threshold": 100,
    "period_to_date_usd": "124800.00",
    "ceiling_usd": "120000.00"
  },
  "interpretation": {
    "stage_origin": "stage_a",
    "confidence_band": "chargeback_ready",
    "degradation_state": "none"
  }
}

No alert storms

Alerting is built to stay signal, not noise:

  • Digests & batching. Choose real-time, hourly, daily, or weekly digests per notification type. A daily budget digest delivers one batched message per day.
  • Coalescing. A connector flapping between healthy and degraded yields a single coalesced entry, not one alert per flap.
  • Scoped mentions. @user and @role mentions notify only people who can already see the object, so an alert never leaks data to someone without access.

Budgets, anomalies, and budget-threshold events can also be rolled into scheduled reports for a regular FinOps digest: see Reporting & exports.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Budgets & alerts
Page: https://docs.venturi.systems/capabilities/budgets-and-alerts/