How the heavy neighbour becomes visible

A pool-wide average hides the neighbour. Every run looks acceptable in the aggregate while one run is quietly taking the whole budget, because the average is pulled up by the many well-behaved runs around it.

What makes it visible is attribution: cost, duration, calls and bytes attached to the run identifier rather than to the pool. With that, a single outlier is a row that can be pointed at instead of a suspicion.

The same attribution is what makes a cap actionable, since a share is only enforceable against a run you can measure. Attribute first, then cap, and review the outliers as a standing report rather than after an incident.

def attribute(run_id, meter, delta):
    meter[run_id] = meter.get(run_id, 0) + delta
    return {"run": run_id, "total": meter[run_id]}

Keep the report per run and per day, so a change in the shape of usage is visible before it turns into contention between runs.