So is the solution to have two thresholds? Notify me urgently if the traffic exceeds 100$, giving me a chance to evaluate what's going on but shut it down at 10

So is the solution to have two thresholds? Notify me urgently if the traffic exceeds 100$, giving me a chance to evaluate what's going on but shut it down at 1000$ if I don't act.