An analyst reviewing a suspicious account answers one question — is this fraud? — and the evidence lives in about a dozen places. Identity, billing, domain reputation, the rules that fired, related accounts, payment attempts. Every review meant opening five systems and rebuilding the same picture by hand.
Solution: a scheduled job read the queue, decide who needs a look, pull every source into one report, ask a model for a verdict, write down that the run happened. The verdict is advisory — nothing here takes any activity. A human still decides and performs the final action.
$1.5 a user, and none of the obvious fixes worked
The product activity data is the expensive part. One review scanned 300 GiB of capped warehouse data and cost $1.5 — against an analyst cost of roughly $0.50 a case, which makes the assistant worse than the problem.
The obvious fixes don't work. Asking for more less data, or asking for one specific user, both bill exactly the same — the way these tables are laid out, a query for one person reads everything anyway.
Once you know the scan is fixed, the answer inverts. If one user costs the same as X users, stop querying per user. One batched query per cycle is byte-identical at every batch size — so the cost just divides.
$1.5 at batch 1, $0.3 at 5, $0.06 at 25. Measured by dry run, not estimated — on-demand BigQuery bills bytes processed, so a dry run is the invoice. A floor of five users means a thin cycle issues no job at all rather than paying $1.5 to review one person.
The neat part is what it doesn't touch. The query runs once per cycle before the fan-out, so concurrency moves the bill by exactly zero, and the whole fix needed no upstream team and no re-clustered copy of a 300 GiB table.
One more, same instinct
Unknown is not false. A source that fails returns "unknown", and a source that's switched off records "not collected" — never empty. Collapse those and you've told the model a real person has no activity, which is a confidently wrong claim, or turned a broken integration into evidence of innocence.