# Production emergency

Agents are burning money right now.

Triage first, containment within days. Priced after triage, because a published number would be negotiating against your incident.

Days · Priced after triage

A public price on an emergency is a number you would negotiate against while your system is on fire. Triage comes first, then a number, then the work.

## Who this is for

- Spend is climbing in a way nobody can explain and nobody can stop.
- An agent loop is running and the kill switch does not exist.
- A production agent is doing something it should not, and you need it contained today.

## Who this is not for

- The system is expensive but stable. That is the cost sprint, and it is a calmer and cheaper conversation.

## What you get

- Triage and spend attribution before anything is touched in the live system.
- Circuit breakers at the tool-call layer, with per-agent and per-tool thresholds.
- Per-session spend caps enforced at runtime, keyed to task type.
- Deterministic policy validation so spend is blocked before execution rather than reviewed after the bill.
- A written postmortem, and the controls shipped into your standard deployment path so it does not happen twice.

## How it runs

### Hours 0-8: Triage

Attribution before intervention. Changing a live system you have not measured is how a cost incident becomes an outage.

### Hours 8-48: Containment

Circuit breakers and spend caps in place at the tool-call layer, with the burn rate visible in real time.

### Day 3+: Postmortem and hardening

What happened, why detection missed it, and the controls shipped into the deployment path so the next one is caught in milliseconds.

## Reported experience

- $40K/day: Projected burn contained within 72 hours of engagement start
- Contained: Historical incident outcome; scope and timeline described in the case
- 72 hours: From engagement start to containment

## Evidence and limits

Anonymized client outcomes (author-reported, reviewed 2026-09-22): Reported by Nick Cerutti; client identities and raw operational records are not public. $200K/year is aggregate savings across engagements. $40K/day was projected exposure; 72 hours describes that incident, not a response or resolution guarantee. Zero-known-incident statements describe observations, not proof of absence.

[Source](https://nickcerutti.com/work)

## Questions

### How fast can you start?

Email rather than the calendar link — that is what the address on this page is for. If the timezone works, same day.

### Why not publish the price?

Because a published number on an incident is leverage for whichever side is not on fire. Triage establishes what is actually wrong, and the number follows from that.

### What if we just need someone to look for an hour?

Then that is what it will be — an hour of triage and a clear read on what happens next, if anything. The scope follows the problem, never the other way around.

## Contact

[Discuss this engagement](mailto:n@nickcerutti.com) · [Pricing and terms](https://nickcerutti.com/pricing)

Canonical page: https://nickcerutti.com/services/production-emergency