# Tutorial: Measure agent cost asymmetry

> **Status:** Lab-only. **No Phase C hard mode.** Defaults: off / observe.

## Goal

Enable the identity-aware tarpit profile and compare external vs internal
session cost ceilings under observe/shadow.

## Prerequisites

- Built sensor
- [agentic-config-keys.md](../reference/agentic-config-keys.md)
- Read [agentic-defense-positioning.md](../explanation/agentic-defense-positioning.md)

## Steps

1. Confirm `agentic_defense.tarpit.enabled: false` by default.
2. Enable:

   ```bash
   export CYBERHALLUCINET_AGENTIC_TARPIT=1
   export CYBERHALLUCINET_AGENTIC_HONEYTOOLS=observe
   ```

3. Run two lab sessions: one with unknown/external identity (expect verbose /
   higher synthetic budget path) and one with an internal enterprise identity
   signal (expect cheap static termination). Unknown identity fails safe to cheap.
4. Confirm per-session ceilings from config (`max_synthetic_tokens`,
   `max_tool_turns`) are honored in telemetry attrs such as
   `agentic_tarpit_profile`.
5. Confirm production task-success paths remain do-no-harm when tarpit is off.

## Expected result

Cost-asymmetry telemetry only. No Phase C hard containment.

## Safety

- Do not copy context-bomb strings into docs.
- Defaults remain off outside this lab.