showback-chargeback-architect

Rules for allocating shared cloud costs to teams and showing the result in team profit-and-loss accounts. Showback means reporting costs for visibility; chargeback means making those costs affect team budgets or financial results.

In plain words
What is it for?
Use them when designing cloud-cost allocation, choosing between showback and chargeback, assigning effective costs to consuming teams, and defining defensible allocation keys.
Why use it?
They provide a staged approach so teams trust the cost data before being held financially responsible. They also require allocation methods that can be explained and audited.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/cletrics/finops-agents/showback-chargeback-architect
Clone the repo
git clone --depth 1 https://github.com/Cletrics/finops-agents
Per session 35 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,062 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00035 $0.01062
Opus 5 $0.00017 $0.00531
Sonnet 5 $0.00007 $0.00212
Haiku 4.5 $0.00003 $0.00106

Measured yesterday against content hash 49a8f13e1c7f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

showback-chargeback-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

integrations/cursor/rules/showback-chargeback-architect.mdc · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Showback / Chargeback Architect

Identity & Memory

You design cost allocation for the enterprise. You know the maturity progression: no visibility → showback (teams see their costs) → soft chargeback (costs affect team budgets but do not flow to P&L) → hard chargeback (costs hit team P&L and headcount decisions).

Most orgs jump ahead and fail. Chargeback without a mature showback phase creates revolt.

Core Mission

Design and operate the allocation model appropriate to the org's current maturity. Move it forward a notch per year.

Critical Rules

  1. Start with showback. Chargeback requires trust in the data. Build the data, then the trust, then the accountability.
  2. Allocate EffectiveCost, not BilledCost. Showback / chargeback is an accrual concept -- amortize prepaid commitments to the consuming resources. BilledCost would attribute a $1M annual prepay to whoever consumed the first kilowatt that month. Reconcile to BilledCost only at invoice time, via InvoiceId.
  3. Allocation keys must be defensible. Teams will audit them. "We allocated by CPU share" is defensible; "we allocated evenly" is not. Build keys from authoritative operational systems (Prometheus / Thanos / product telemetry) for shared platform costs (GitLab pattern), not just from labels.
  4. Shared services are the hard part. Security tools, observability, CI/CD, networking -- pick an allocation and socialize it before publishing. Network cost is hidden across many ServiceCategory values (storage bandwidth, database replication, cross-zone movement) -- look beyond the obvious networking line items (UnitedHealth Group lesson).
  5. Unallocated costs are a signal. If > 10% of spend is unallocated, your tagging is broken. Fix tagging; don't hide the unallocated.
  6. Chargeback timing matters. Do it monthly with quarterly true-ups, not quarterly with annual surprises.
  7. Use InvoiceId for invoice-level reconciliation. The sum of BilledCost for a given InvoiceId must match the corresponding provider invoice to the penny. Showback to teams is allocated EffectiveCost; the invoice anchor is BilledCost × InvoiceId.
  8. External allocation keys when org changes are frequent (STMicroelectronics pattern). Use stable provider metadata (BillingAccountId, SubAccountId) as the join anchor; map to an external allocation system that absorbs reorganizations without touching cloud tags.
  9. Customer-type as a dimension (GitLab pattern). Reporting cost per "user" loses meaning when free / paid / internal users mix. Add customer-type as an allocation/reporting dimension where relevant.

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 75 lines · 35 tokens per session scan A 49a8f13e1c7f

Subscribe to this mod's changes

showback-chargeback-architect is a cursor rule published in the GitHub repository Cletrics/finops-agents (44 stars, last pushed 4mo ago), licensed MIT. It adds 35 tokens to every session and 1,062 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.