The Funnel Rule

Measured in this session · not a model

$239.01

The most expensive thing you can do is delegate

Researching this guide, I launched four research agents. Those four spawned others, which spawned others — 35 agents, 2,716 API calls, $239.01 from a single request. That is your entire monthly budget, plus 20%, spent on one prompt while I was investigating how to avoid spending it.

Nothing else in this document comes close. Agent fan-out is the only pattern that can produce a four-figure bill from one sentence, because each agent pays full context cost and each one can spawn more without asking you. Subagents buy parallelism and speed — never savings. Measured on six independent investigations, six subagents cost 28% more than doing them inline.

The rule: cap it explicitly, every time. Say "use at most 3 agents and tell them not to spawn any of their own." Without that sentence there is no ceiling.

01 — The rule

Filter, then read

10⁵–10⁷ events → grep · jq · KQL · SQL · pandas → 1–5 records → read 20–200 lines

This is the shape of almost all IAM work. Research across 64 distinct investigation types found that roughly 25 of them terminate in reading a single artifact — one SAML assertion, one JWT, one dsregcmd /status, one Duo log record. The corpus is enormous; the answer is tiny.

Get that right and your day-to-day diagnostic work costs cents. Get it wrong once on a big log and it costs more than a month of everything else. The gap on a single real example:

One week of Okta System Log

$57,786

Read into context in 200k chunks. 210M tokens — it exceeds a full context window 210 times over, so it can't even work.

Same investigation, filtered first

$0.63

jq to the ~40 relevant events, then read those. Same answer, 91,000× cheaper.

The tell, while it's happening

Read ×N

A long run of Read calls on data files with the context indicator climbing. Stop and say "filter it first."

02 — Classification

Three cost classes, and how to tell them apart

Before starting any task, put it in one of three buckets. The bucket determines the pattern, and the pattern determines whether you spend cents or hundreds.

Class	What it looks like	Correct pattern	Typical cost
Funnel	Huge corpus, tiny answer. Log hunts, error triage, "why was this user blocked", policy evaluation.	Filter with a CLI/KQL query outside the model, paste only the matches. Never paste a log file.	$0.20 – $2
Bulk	Every row matters. Reconciliation, entitlement diffs, fleet sweeps, transitive group counts.	Model reads 2–3 samples, writes a Python/PowerShell script, the script reads everything.	$3 – $12
Reasoning	One dense artifact, no error message, every layer reports success. PKI chains, encrypted assertions, group overage.	Paste the single artifact. Use Opus. Think hard. This is what the model is for — and it's cheap because the data is small.	$0.50 – $3

Note what is not here: an expensive class. Done correctly, no routine IAM task costs more than about $12. Every four-figure scenario in this guide comes from misclassifying a Funnel or Bulk task as "just read the files."

03 — The reference table

Your work, priced

Task volumes are from research across Entra, Okta, SailPoint, Duo and PCI/SOC 2/CMMC control sets, calibrated to a 5,000-seat enterprise. Costs are modelled at Opus 5 list rates.

Task	Class	Model	Real data volume	Wrong way	Right way	The move
SSO / SAML failure debug	Funnel	Sonnet	HAR = 8 MB / 2M tokens. Assertion = 40–80 lines.	$21.57	$0.48	Extract the decoded assertion. Never paste a HAR.
Sign-in log / error-code triage	Funnel	Haiku	50k–10M events/day → 1–5 after correlation ID	$5,000+	$0.30	Filter by correlationId in the portal or KQL first.
Okta System Log investigation	Funnel	Sonnet	1.5–3M events/day; a week = 210M tokens	$57,786	$0.63	`jq`/API filter on eventType + user, then read.
Conditional Access gap analysis	Funnel	Opus	~10M records/30d → 50–400 tuples → 5–30 real	$2,700	$1.50	KQL summarize in Log Analytics. Paste the summary.
200-file Excel reconciliation	Bulk	Sonnet	200 files × 500 rows = 4.5M tokens	$96	$3.67	3 samples → pandas script → run it.
Directory ↔ HR reconciliation	Bulk	Sonnet	20k–200k accounts vs 10k–30k identities	$13.37	$2.45	Sample 20 rows, write the join, run it.
Access review / UAR campaign build	Bulk	Sonnet	3,000–20,000 pairs × 200–600 reviewers	$60+	$4	Script the generator. Model never sees the rows.
Transitive group / token-bloat sweep	Bulk	Sonnet	1k–50k users, each a Graph paged count	$200+	$5	Graph script + counter. Model reads the histogram.
Fleet certificate expiry sweep	Bulk	Haiku	50–500 SAML apps via Graph/Okta API	$25	$2	Script enumerates; model reads the expiring 12.
SoD conflict analysis	Bulk	Sonnet→Opus	5k–30k users × 500–5k entitlements × 50–500 rules	$300+	$6	Script the matrix. Model adjudicates the ~200 real ones.
Encrypted assertion / PKI chain debug	Reasoning	Opus	1 opaque blob + 2 openssl outputs	—	$0.80	Paste it and think. Small data, high value.
Group-claim overage / authz-vs-authn	Reasoning	Opus	1 token (0–200 groups) + 1 transitive count	—	$1.20	Paste token + the count, not the group list.
CA policy "what if" reasoning	Reasoning	Opus	Zero log records — policy config only	—	$0.60	Paste the policy objects. No logs needed at all.
Build an internal tool / review UI	Reasoning	Opus	15–40 turn build, code not data	—	$5 – $14	One continuous session. Do not split it.
Okta Workflows / connector design	Reasoning	Sonnet	Config + docs, no bulk data	—	$1 – $4	Naturally cheap. Just don't paste a user export.

"Wrong way" = the naive read-it-all approach. Where it shows a dash, there is no expensive version — the task is small-data by nature. Note the pattern: every expensive row is a Funnel or Bulk task being treated as a Reasoning task.

05 — Model routing

Which model, and why the best one is not always right

Routing is the second-biggest lever after keeping data out of context. Modelled over a realistic IAM week, running everything on Opus costs $117/month; routing each task to the right tier costs $78/month — 33% saved, with no loss of quality.

The rule is counterintuitive: spend your best model where the data is smallest. Reasoning tasks cost $0.50–$3 because the artifact is one assertion or one token — so Opus is nearly free there, and worth every cent. Funnel and Bulk tasks are where the volume lives, repeated many times a week, and they are mostly mechanical. That is where Sonnet and Haiku belong.

Tier	vs Opus	Use it for
Haiku 4.5	0.2×	Error-code triage, fleet sweeps, format conversion, and subagent workers. Anything where volume beats judgment. Saves 80%.
Sonnet 5	0.6×	Your default. Script authoring, SAML debugging, reconciliation logic, Workflows design, routine investigation. Saves 40% and loses nothing on well-trodden ground.
Opus 5	1×	PKI chains, group-claim overage, policy gap analysis, tool building. The cases where every layer reports success and there is no error to look up — plus any long agentic build.
Fable 5	2×	Anthropic's most capable model, at double Opus. See the note below — on this workload it does not pay for itself.

Rates per million tokens: Haiku 4.5 $1/$5 · Sonnet 5 $3/$15 · Opus 5 $5/$25 · Fable 5 $10/$50.

On Fable 5

Upgrading the hard tasks costs more than the routing saves

Fable is the obvious candidate for the hardest debugging — but run just the Opus-class jobs on Fable and the month goes from $78 to $124. That is more than running everything on Opus ($117). The upgrade costs $46/month and wipes out the entire $39 routing saving.

Reserve it for a genuine stuck point where being wrong is expensive — a production outage, a PKI chain nobody can crack — not as a default.

Switching

Type /model in Claude Code to change tier. Switching invalidates the prompt cache, so change it at the start of a task rather than partway through — flipping models on turn 20 of a long session re-pays the whole accumulated context as a fresh cache write.

04 — Estimator

Price it before you run it

Rough out any task in ten seconds. The engine is the same one used for every figure above. Turn count matters because every turn re-sends the whole conversation — turn 30 pays to re-read turns 1–29, which is why cost climbs faster than the work does.

Task shape

Raw data size (MB) Total size of logs, exports or files involved — not what you paste.

Back-and-forth turns One turn = your message + Claude's reply. Quick question 1–3, troubleshooting 5–10, building something 15–40.

Model

If you paste the data

—

If you filter/script first

—

Difference

—

Adjust the inputs above.

06 — Pre-flight

Six questions, before you start

How big is the data I'm about to involve? Over ~1 MB, it does not go in context. 1 MB ≈ 250,000 tokens ≈ $2.50 just to read once, and again on every turn after.
Does every row matter, or am I looking for a needle? Needle → filter outside the model. Every row → write a script. Only "one dense artifact" gets pasted directly.
Am I about to say "read all the files in this folder"? That sentence is the single most expensive thing you can type after agent delegation. Replace it with "write a script that processes this folder."
Do I actually need agents — and did I cap them? Agents cost more, not less. If you want parallelism, say the number and forbid nesting: "at most 3 agents, none of them may spawn their own."
Is this a fresh context, or am I 200k tokens into something else? The same 10-turn task costs $1.73 from a clean start and $10.43 from a 600k context. Start big work fresh; never split work that's genuinely continuous.
Does this need Opus? Sonnet is 40% cheaper, Haiku 80%. Use Opus for the Reasoning class — PKI, overage, policy logic. Use Sonnet or Haiku for scripting, formatting, and triage.

07 — Phrasing

Say this, not that

The cost difference between these pairs is one to four orders of magnitude. The work produced is identical.

Costs hundreds

Read all 200 access exports and cross-reference them.

Costs about $4

Look at 3 of these exports, then write me a script that reconciles all 200.

Cannot even complete

Here's the Okta System Log for last week — find the failed logins.

Costs under $1

Give me the jq filter for failed logins, I'll run it and paste the matches.

Costs $20+

Here's the HAR file from the failed SSO attempt.

Costs $0.50

Here's the decoded SAML assertion from the failed attempt.

Unbounded

Research this thoroughly using agents.

Bounded

Use at most 3 agents, and tell them not to spawn any of their own.

08 — Guardrails

What to ask your company for

Discipline is necessary but not sufficient — one mistyped instruction can still produce a large bill. Ask for three things alongside the licence, and none of them are hard:

Workspace spend limits in the Anthropic Console A hard ceiling per workspace. This is the control that makes a runaway session impossible rather than merely unlikely. Non-negotiable — ask for it first.
Sonnet as the default model, Opus on request 40% off the baseline for work that loses nothing by it. Reserve Opus for architecture, PKI-class debugging, and long agentic runs.
A two-week pilot measured on the Console dashboard Replaces every estimate in this document with your own numbers, on your own work, for a few hundred dollars. That is the honest way to size the budget.