TL;DR: Most engineering teams can see total AI spend but not decompose it by team, model, or person, making token counts a poor proxy for cost when caching, model mix, and passthrough subscriptions distort the bill, according to Tetrate. The operational problem is governance, not raw usage: cost control depends on identity, attribution, and budget enforcement at the gateway.
At a glance
What this is: This is a breakdown of AI token-cost governance showing that spend control works only when usage can be attributed by team, model, and person.
Why it matters: It matters because AI gateways are becoming governance points for agentic AI usage, and identity-linked attribution is what turns spend data into enforceable controls.
By the numbers:
- Organization scope, last 24 hours: $642.50 across 7.6K requests and 767.8M tokens.
- Organization scope, last 30 days: 42B tokens, of which 37.6B cache reads, 2.2B cache creation, 2B fresh input, and 228.7M output.
Context
AI token spend becomes a governance problem when the organisation can see only a monthly total and not the teams, models, users, or sessions that created it. In agentic AI environments, that gap matters because cost, access, and accountability all move together, and the gateway is often the only control plane that sees the full picture.
The article shows a practical identity angle inside a broader cost-management story. When caller identity, team mapping, and key ownership are wrong, spend is charged to the wrong cost centre and budget controls lose meaning. That makes AI gateway telemetry a governance control, not just an observability feature.
The pattern is typical for early AI adoption: high usage, low attribution, and control decisions made from incomplete data. As more teams adopt coding agents and shared AI infrastructure, the absence of identity-linked billing becomes a recurring governance weakness rather than a one-off reporting gap.
Key questions
Q: How should teams govern AI consumption when spend is spread across multiple tools?
A: Start by assigning one control owner for AI consumption governance and require shared evidence from finance, IT, and security. Then map usage back to the identity or workflow that generated it so spend, access, and accountability stay linked. Without that join, AI usage becomes visible only as a cost, not as governed behaviour.
Q: Why do AI token totals and actual cost often diverge?
A: Because model pricing is not linear. Cached reads, cache creation, fresh input, and output tokens are priced differently, so two workloads with similar token counts can produce very different bills. Effective cost per million tokens is the more useful metric when deciding where to intervene.
Q: What breaks when AI usage is not mapped to the right team?
A: Chargeback and budget ownership break first, followed by any attempt to compare spend across departments. A user shown as No team or attached to the wrong team can make the organisation think one group is overspending when the real issue is bad identity mapping.
Q: How should organisations decide who needs a Claude Code subscription?
A: Compare each person’s passthrough value against the seat price. If the person is generating far more metered usage than the subscription costs, keep the seat. If the passthrough value is far below the seat price, reclaim it and shift that workload to metered access.
Technical breakdown
Why AI gateway telemetry becomes the control plane
AI gateway telemetry matters because it joins model requests, token counts, cost, and caller identity in one record. That matters more than per-session controls inside a coding agent because those controls only see one machine or one session at a time. Once usage crosses teams and models, the governance question stops being how much one tool spent and becomes who consumed what, under which identity, and against which budget. The gateway is therefore the place where attribution can be made consistent before the data fragments into separate provider logs.
Practical implication: enforce cost attribution at the gateway, not inside individual agent tools.
Why tokens and spend diverge in agentic AI environments
Token volume is not a reliable proxy for cost because cache reads, cache creation, model pricing, and output tokens are all priced differently. A model can account for a small share of tokens and a much larger share of cost, which makes a token cap a blunt instrument for finance or engineering governance. In practical terms, the bill reflects behaviour patterns, not just volume. That is why model mix and caching efficiency need to be reviewed together, otherwise teams can meet a token target while still overspending.
Practical implication: review effective cost per million tokens alongside cache reuse and model mix.
Identity mapping is the hidden dependency behind showback and chargeback
Spend controls only work when user, key, and team relationships are correct. If a user is mapped to the wrong team, or appears as No team, the organisation cannot trust its chargeback or its budget ownership. In agentic AI programmes, that is more than a reporting defect because it weakens accountability for subscription seats, shared usage, and budget exceptions. The technical issue is not simply missing metadata. It is a broken ownership chain between the identity provider, the gateway, and the cost centre.
Practical implication: reconcile team mappings before using AI spend data for chargeback or budget enforcement.
Threat narrative
Attacker objective: The objective is not theft but uncontrolled consumption and misattributed spend that weakens governance over AI usage.
- Entry occurs when engineering teams route AI and coding-agent traffic through shared gateways without consistent identity mapping, so usage arrives with incomplete ownership context.
- Escalation happens when one user holds many API keys or when subscriptions and metered traffic are split across different paths, making true consumption hard to reconstruct.
- Impact is financial and governance drift, with budgets, seat allocation, and team accountability all based on partial data rather than a complete usage record.
Breaches seen in the wild
- Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI spend governance is now an identity problem, not a billing problem. Once token usage spans coding agents, shared gateways, and multiple provider paths, the control question becomes who used what and under which ownership chain. Finance-only views cannot enforce budgets if the identity-provider mapping is wrong, because chargeback and accountability both collapse. Practitioners should treat AI gateway attribution as part of identity governance.
Token counts are a weak governance primitive when model pricing and cache behaviour diverge. The article shows that cost and volume can move in different directions, which means a token ceiling can leave the real spend problem untouched. That is especially true in agentic AI programmes where cached input, fresh input, and output all price differently. The right concept is cost observability with ownership, not raw consumption control.
Shared AI infrastructure creates a new form of governance debt: uncoupled usage and responsibility. A user with one key and another with thirteen keys can look similar in a high-level dashboard while representing very different operational realities. That gap matters because budgets, exceptions, and seat allocation depend on whether the platform can distinguish people, teams, and purposes. Practitioners should assume the first failure will be attribution, not tokenisation.
Passthrough subscriptions complicate security and governance because one person can have two economic identities. A developer may appear under a flat plan for one workload and metered API usage for another, which makes single-source accounting impossible unless the gateway can reconcile both. That is a strong signal that agentic AI governance will need consolidated identity, spend, and usage records. Teams should design policy around the person, not just the provider account.
Agentic AI adoption is outpacing control maturity, and spend management is one visible symptom. The broader problem is that organisations are moving into autonomous workflows before they can reliably attribute traffic, budgets, and subscription value. That leaves unmanaged variation between teams, models, and seats. Practitioners should use AI spend control as an entry point into wider agentic AI governance, including identity, tool access, and usage review.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- According to PwC, 79% of organizations have already adopted AI agents to some degree.
- Read next: Agentic AI Identity Maturity Model
What this signals
AI spend controls will increasingly sit inside identity governance, because attribution is what turns usage data into accountability. The next maturity step is not another dashboard but a reliable ownership chain from identity provider to gateway to budget owner. Organisations that cannot reconcile users, keys, and teams will keep mistaking reporting gaps for cost problems.
Agentic AI introduces a governance debt pattern that many teams will recognise from early cloud programmes. Usage grows faster than ownership, and the first visible symptom is not usually an outage but a bill that cannot be explained cleanly. The practical response is to treat team mapping, subscription seat allocation, and gateway telemetry as one control surface.
For practitioners
- Implement gateway-level cost attribution Capture caller identity, model, token counts, and team mapping in the same control plane so spend can be decomposed consistently across providers.
- Reconcile identity-provider team mappings Audit every No team record and every mismatched user-to-team assignment before using usage data for chargeback or budget enforcement.
- Review effective cost per million tokens Compare token volume, cache reuse ratio, and model mix together so you can spot expensive workloads that a simple token cap would miss.
- Separate budget alerts from rate limits Use budgets as forecasting and accountability controls, and reserve inline blocking for bursty or non-production workloads where rejection is acceptable.
- Rationalise subscription seat allocation Compare passthrough value against seat price for each person, then reclaim flat-rate seats that are materially cheaper on metered usage.
Key takeaways
- AI token spend is hard to control when usage data cannot be tied back to teams, people, and models.
- Gateway telemetry matters because it links identity, cost, and model behaviour in one record.
- Budgets and subscriptions only work as controls when ownership mappings are accurate and reviewed regularly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Human operators are using gateway-managed AI credentials and subscriptions as shared identity-linked access paths. |
| Recommendation — Review human use of AI credentials and gateway access under NHI-10 so ownership and purpose stay explicit. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Team and user mapping determine whether AI spend is charged to the right owner and governed correctly. |
| GV.OC-01 — Organizational Context | The article is about assigning responsibility for AI usage, budgets, and subscriptions across the organisation. | |
| ID.AM-01 — Physical Devices and Systems Inventoried | The gateway must inventory users, API keys, models, and subscriptions before spend can be attributed reliably. | |
| Recommendation — Apply PR.AA-05 to keep AI access and cost ownership aligned with verified team entitlements. Define who owns AI spend governance and how budgets, chargeback, and exceptions are authorised. Inventory AI users, keys, models, and subscriptions before using spend data for governance. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | User, team, and key ownership drive the attribution logic behind AI spend control. |
| IA-5 — Authenticator Management | API keys and subscriptions act as authenticators for AI usage and need lifecycle control. | |
| Recommendation — Use AC-2 to keep AI accounts, keys, and ownership records current for chargeback and review. Apply IA-5 to manage AI API keys, rotation, and revocation across teams and workloads. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article’s identity-linked AI access paths can be abused if keys, subscriptions, or mappings are mismanaged. |
| Recommendation — Map AI key abuse to TA0006 and TA0008 to prioritise detection of credential misuse and spread across tools. | ||
Key terms
- AI Gateway: A control point that sits between AI applications and the models, tools, or data they call. In practice, it can authenticate requests, enforce policy, inspect runtime behaviour, and stop unsafe actions before they spread into connected systems.
- Passthrough Mode: Passthrough mode is a routing pattern where a user’s traffic is observed by the gateway but billed or authenticated through a separate subscription or provider path. It is useful for comparison, but it complicates chargeback unless identity and usage records are reconciled.
- Effective Cost Per Million Tokens: Effective cost per million tokens is a normalised cost measure that shows what a workload really costs after model pricing, cache behaviour, and output mix are taken into account. It is more useful than token volume alone when comparing AI usage across teams or models.
- Cache Reuse Ratio: Cache reuse ratio measures how often cached prompt context is read back relative to how often it is created. In AI systems, a high ratio usually indicates efficient reuse of stable context, while a low ratio can reveal prompt churn, poor structuring, or unnecessary re-computation.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management in the context of practical identity control. It helps security and platform teams connect access, ownership, and lifecycle decisions across modern AI programmes.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org