Finance asks why monthly Claude spend for a multi-tenant SaaS product rose 70% while active users rose 10%. Today, the only data is total tokens per day from billing. Which approach will most directly identify the cause?

Answer: A — Record per-call token usage, including cache reads and writes, tagged by tenant, feature and step, then aggregate

Attribution needs usage at the step level with business dimensions attached. Cache read and write counts reveal prefixes that stopped caching, and tenant or step breakdowns reveal looping workflows or oversized tool results. (b) detects overspend but explains nothing. (c) is guesswork. (d) truncates outputs blindly and can break correct answers without addressing the cause.