LLM cost attribution needs request-level metadata, not invoices

At a glance

What this is: This is a playbook for attributing LLM spend at the request level, with the key finding that invoice-level reporting cannot explain which user, feature, or agent run caused cost spikes.

Why it matters: IAM, NHI, and AI security teams need request-scoped attribution because cost controls only work when spend is tied to the identity, workflow, and run that produced it.

Context

LLM cost governance fails when finance-level billing is treated as operational truth. A single invoice can show that spend rose, but it cannot tell teams whether the cause was a prompt change, an agent loop, retry storms, or a customer-specific workflow, so investigation has to happen at the request level.

The identity connection is real here because every model call needs a traceable requester, workflow, and run context. Without that linkage, teams cannot govern per-user, per-feature, or per-agent-run spending in a way that supports both engineering decisions and access-like accountability over AI usage.

Key questions

Q: What breaks when LLM cost is tracked only in invoices?

A: Finance may see the spend, but engineering cannot identify which user, feature, prompt change, or agent run caused it. That leaves teams guessing during investigations and slows responses to retry storms, prompt bloat, and runaway agents. Request-level attribution is what converts spend from a billing fact into an operational signal.

Q: Why do request-level metadata and cost rollups matter for AI spend control?

A: They turn spend into an operational signal. When model calls carry user, feature, customer, deployment, prompt version, and run metadata, teams can compare cost across workflows, spot regressions, and connect economics to quality outcomes instead of relying on finance totals that arrive too late to guide action.

Q: How do teams know if LLM cost controls are actually working?

A: Look for stable cost per feature request, bounded cost per agent run, and no widening gap between median and p99 spend. If alerts, caps, and kill switches are working, unusually expensive runs should be visible early and contained before they distort invoices or customer margins.

Q: What should security and AI teams do when agent runs start retrying or looping?

A: Treat the behaviour as a control failure, not just a usage anomaly. Stop the run, inspect the span tree for repeated tool calls or retry storms, and tighten the budget, ceiling, or routing rule that allowed the loop to continue without intervention.

Technical breakdown

Why invoice-level LLM costing breaks down

Invoice totals are aggregate accounting artifacts, not operational telemetry. They show what was billed after the fact, but they do not preserve the request chain that produced the spend. In practice, three patterns hide inside invoices: runaway agent loops that repeat tool calls, retry storms that inflate token use behind a successful final response, and context bloat from prompts or retrieved content that quietly raises the average cost per request. The control problem is attribution, not arithmetic. Practitioners need cost attached to the same trace as the model call so behaviour, not only spend, can be investigated.

Practical implication: treat invoice data as finance input only and move operational cost visibility to request traces.

Request-level metadata for LLM spend attribution

Request-level attribution means the span that records the model call also carries the metadata needed to explain it. Fields such as user_id, customer_id, feature, deployment, prompt_version, and agent_run_id let teams roll up spend by account, surface, environment, and workflow. That structure turns a raw model call into a governable event because cost can be queried alongside product context and quality outcomes. The key design choice is to tag at the call site, not parse logs later, because logs lose context and often collapse multiple behaviours into one opaque completion record.

Practical implication: attach cost-relevant metadata when the request is created, not after the fact.

Why rollups, caps, and kill switches have to sit together

Rollups answer where spend concentrates, but they do not stop waste on their own. User caps, feature alerts, and agent-run kill switches create the control layer that turns attribution into action. Low-cardinality dimensions such as feature, deployment, and model work well for charts and alerts, while high-cardinality fields such as user_id and agent_run_id are better kept for trace drill-down. That distinction matters because the operational goal is not just to see cost, but to interrupt unbounded growth before a loop, retry pattern, or expensive workflow runs past acceptable limits.

Practical implication: pair attribution with enforcement so the same telemetry can both explain and halt excess spend.

NHI Mgmt Group analysis

LLM cost attribution is becoming a governance problem, not just a FinOps problem. When model spend cannot be tied to a user, feature, prompt version, or agent run, the organisation has lost operational accountability for AI usage. That creates the same kind of control gap identity teams see when shared credentials obscure who actually performed an action. The practitioner conclusion is that request metadata must be treated as part of the control plane, not as optional analytics.

Request-level metadata is the named concept that makes LLM economics governable. It is the difference between knowing that spend increased and knowing why it increased, which is the difference between reporting and control. In a mixed human and agentic AI environment, the same trace needs to connect requester, workflow, and run so that cost, quality, and reliability can be reviewed together. Practitioners should treat metadata capture as an architectural requirement, not a reporting enhancement.

Runaway loops are the LLM equivalent of standing privilege in identity systems. Once a request can keep generating cost without an intervening control point, the organisation has allowed uncontrolled continuation of access to budget. That makes kill switches and hard caps governance controls, not convenience features. The practitioner takeaway is to stop assuming end-of-invoice review is sufficient for AI cost oversight.

AI cost control needs traceability across quality, latency, and spend at the same decision point. Reducing cost while degrading eval pass rate or increasing latency simply moves the problem elsewhere. The right control model is therefore release-gated and request-scoped, where cost changes are checked against quality signals before production exposure. Practitioners should align AI spend governance with the same discipline used for production change control.

LLM cost visibility exposes where agentic behaviour needs tighter authorization boundaries. If an agent run can loop, retry, or expand context without clear ownership, then the issue is not only cost but governance over the agent itself. That is why cost attribution and agent identity belong together in mature AI operations. Practitioners should use cost traces to identify where agent permissions, budgets, and run ceilings need to be narrowed.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

LLM cost attribution is now part of AI governance. When request metadata is missing, teams cannot separate normal usage from loops, retries, or prompt changes, so the control point has to move from the invoice to the span. That is the practical boundary between spend monitoring and governable AI operations.

Request-level telemetry creates a stronger control model than invoice review alone. It lets practitioners connect cost to the user, feature, and agent run that produced it, which is essential when AI systems behave more like dynamic workflows than static applications. The operational consequence is earlier intervention and less guesswork during incident triage.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. That scale underscores why request-scoped tracing and hard execution ceilings matter when AI systems can amplify both cost and exposure across their supporting stack.

For practitioners

• Implement request-time metadata tagging Attach user_id, customer_id, feature, deployment, prompt_version, and agent_run_id at the model call so cost can be rolled up from the same trace that records the request.
• Build cost rollups by operational dimension Create daily rollups for cost per user, cost per feature request, cost per agent run, and cost per successful eval so spend can be evaluated against product and quality outcomes.
• Set low-cardinality alerts and high-cardinality drill-downs Alert on feature, deployment, and model combinations, then use user and agent run identifiers only for trace-level investigation when an alert fires.
• Enforce user caps and agent kill switches Block or throttle requests when a user crosses a daily budget, and stop agent runs when token count, retry count, or span depth exceeds the ceiling for that workflow.
• Normalize provider pricing in one registry Maintain model price tables with owners and update triggers for provider pricing changes, cache behaviour, batch rules, and fine-tuned models so attribution stays aligned to billed usage.

Key takeaways

• LLM spend becomes difficult to govern when the organisation treats finance invoices as the primary record instead of request-scoped telemetry.
• The useful control point is the trace, because it can connect cost to the user, feature, prompt version, customer, and agent run that produced it.
• Cost rollups, alerts, caps, and kill switches work best when they are designed together rather than added as separate reporting and response layers.

Key terms

• Gateway-Level Cost Attribution: Gateway-level cost attribution is the practice of assigning AI spend at the point where requests enter the gateway, rather than waiting for provider invoices. It lets organisations connect usage to team, application, feature, and environment while preserving routing freedom across models and providers.
• Agent Runaway: Agent runaway is a failure mode where an AI agent keeps acting beyond its intended task, often by looping through tool calls or repeated actions. This can drive cost, expand access, and increase exposure to downstream systems. The issue is usually scope control, not model quality alone.
• Cost Rollup: A cost rollup is an aggregation that groups request-level spend by a meaningful operational dimension such as user, feature, customer, or model. It helps teams compare workflows, isolate abnormal usage, and connect spend to quality or margin outcomes without losing the trace-level detail needed for investigation.
• Kill Switch: A kill switch is an emergency control used to stop an autonomous system from taking further action. In security practice, it is a containment mechanism, not a governance strategy, because it does not prevent prior overreach or replace least-privilege design.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect identity controls to the broader governance decisions their programmes now have to make.