TL;DR: Enterprises moving LLMs into production face a hidden AI fragmentation tax as disconnected tools, providers and environments obscure token costs until the invoice arrives, according to Kong. The governance issue is attribution: if teams cannot measure consumption by application or business unit, they cannot control AI spend or enforce accountability.
At a glance
What this is: Kong's article explains how LLM showback and chargeback address the hidden fragmentation tax created when token consumption is spread across disconnected AI tooling and providers.
Why it matters: IAM, FinOps and platform teams need traceable AI consumption data because accountability for LLM usage depends on attribution, not just metering.
Context
LLM cost governance is the discipline of making AI consumption visible, attributable and accountable across teams, applications and services. In practice, the same governance problem that FinOps solved for cloud infrastructure is now appearing in AI, only faster because token-based usage is harder to see until billing arrives.
Kong frames the issue as a fragmentation problem rather than a pricing problem. When workloads span multiple models, providers and environments, cost becomes difficult to assign to the team that created it, which weakens budget control and slows rational decisions about AI adoption.
Key questions
Q: How should teams implement LLM showback in a production AI platform?
A: Start by mapping each LLM request to a specific team, application or service, then report token usage in a way that the consuming group can understand and challenge. Showback only works when the consumption record is trusted enough to influence behaviour, model choice and budget planning.
Q: When does chargeback become more useful than showback for AI governance?
A: Chargeback becomes useful when attribution is stable, pricing rules are understood, and leaders need teams to feel the budget impact directly. If usage is still fragmented across tools or teams cannot agree on allocation logic, chargeback will create disputes before it creates control.
Q: What breaks when token usage cannot be attributed to one owner?
A: Cost governance breaks because finance can see spend but cannot tie it back to the team, workflow or product that caused it. That makes optimisation harder, delays corrective action and turns AI adoption into a pooled cost problem rather than an accountable operating model.
Q: Should organisations meter AI costs at the gateway or in finance systems?
A: Meter at the gateway when possible, because that is where consumption is created and where request, model and token data are still intact. Finance systems are necessary for invoicing, but they are too far downstream to provide the operational detail needed for governance.
Technical breakdown
Why token-level attribution becomes the control point
LLMs do not consume infrastructure in the same way as a virtual machine or storage bucket. The accounting unit is the token, and token usage only becomes operationally useful when it can be tied to a team, application or service in real time. Without that attribution layer, organisations can observe total spend but cannot distinguish experimentation from production demand, or business value from waste. That is why showback is a governance mechanism, not just a reporting view: it turns opaque usage into a measurable control surface.
Practical implication: build token attribution into the AI delivery path, not into a separate spreadsheet after the invoice lands.
Showback versus chargeback in AI governance
Showback exposes consumption without directly allocating cost, while chargeback converts consumption into financial responsibility for the consuming unit. The difference matters because visibility alone changes behaviour only partially, whereas a direct cost allocation affects prioritisation, model selection and experimentation pace. Kong's framing reflects a broader governance pattern: organisations often need showback first to establish trust in the data, then chargeback when internal accountability and invoicing are mature enough to support it.
Practical implication: sequence AI cost governance so that teams first trust the measurement and only then absorb cost consequences.
How metering and billing change the AI control plane
A metering layer attached to the AI data path can collect request volume, token counts, model version data and provider-level pricing, then translate those signals into unit economics for each service or business unit. That is materially different from post-hoc finance reconciliation because the control sits at the point of consumption. In enterprise terms, this is where AI cost governance starts to resemble IAM and entitlement discipline: usage visibility, thresholding and accountability all depend on the same authoritative record of who consumed what, and when.
Practical implication: align AI metering with existing platform governance so entitlement, budgeting and enforcement use the same source of truth.
NHI Mgmt Group analysis
AI cost fragmentation is now a governance problem, not an expense-reporting problem. When token consumption is spread across models, providers and environments, the enterprise loses a single accountable view of AI use. That breaks the basic governance assumption that spending can be traced back to the team that created it. Practitioners should treat AI cost attribution as part of platform control, not as a finance afterthought.
Showback is the minimum viable control for AI accountability. Teams need visibility before they can be expected to change behaviour, but visibility alone does not enforce discipline. The important shift is from anonymous usage to attributable consumption, because that is what makes budget conversations and model governance possible. The practitioner conclusion is simple: if you cannot allocate usage, you cannot govern scale.
The hidden AI fragmentation tax is a useful name for a familiar failure mode. Disconnected tools and providers create compounding waste because each layer optimises locally while the enterprise absorbs the aggregate cost. That pattern is already common in cloud, and AI is repeating it with less time to react. The implication is that AI platform teams should design for cost aggregation early, before fragmented adoption becomes institutionalised.
Chargeback changes behaviour only when the cost record is authoritative. A chargeback model without trusted metering just moves disagreement downstream into finance disputes. The control problem is therefore record quality: the organisation needs one defensible accounting layer for token usage, model pricing and ownership. Practitioners should align financial accountability with the same consumption data that drives platform enforcement.
LLM unit economics now sit inside identity and access governance decisions. Once teams can see which service, workflow or application consumed which model capacity, cost and access control start to converge. That matters because AI usage is becoming a governed enterprise privilege, not a free technical convenience. The practitioner takeaway is to treat AI consumption records as part of the control plane, not a separate reporting artifact.
From our research library:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
AI fragmentation tax: enterprises that spread LLM usage across multiple providers and disconnected tools will struggle to understand true unit economics unless cost attribution becomes part of the platform design. The control question is no longer whether AI is expensive, but whether each workload can be measured well enough to justify itself.
Showback is the right bridge between usage visibility and financial accountability because it creates a trusted baseline before chargeback introduces consequences. For platform teams, that means treating token metering as an operational record, not a finance export.
State of Secrets Sprawl 2026 found AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers. That is a reminder that AI governance failures rarely stay inside one layer of the stack.
For practitioners
- Define a token attribution model Map each LLM request to a team, application or service before you attempt cost allocation, so consumption data can be trusted across finance and engineering.
- Start with visibility before enforcement Use showback to establish a reliable baseline for request volume, token counts and model cost, then introduce chargeback only after the reporting data is stable.
- Meter cost at the AI gateway Collect token usage, provider pricing and model version data at the point where traffic enters the AI path, not after the fact in finance systems.
- Set usage entitlements for high-spend workflows Apply real-time thresholds to the workflows that drive the most AI spend so overruns are visible before they become quarter-end surprises.
- Align finance and platform ownership Assign a clear owner for the consumption record so budget disputes do not arise when teams question which business unit should absorb the cost.
Key takeaways
- LLM cost governance fails when token consumption is spread across disconnected tools and providers with no authoritative owner for the spend.
- Showback gives teams visibility, but chargeback only works after the consumption record is trusted enough to support accountability.
- The practical fix is to meter usage at the point of consumption and tie it to a team, application or service before finance gets involved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API4 — Unrestricted Resource Consumption | Token-based LLM spend is fundamentally a consumption-control problem in an API-driven AI stack. |
| Recommendation — Apply API4-style limits to AI request paths and bound token-heavy workflows before costs scale unchecked. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | AI showback and chargeback depend on knowing which team or service is authorised to consume which capacity. |
| Recommendation — Tie AI consumption records to PR.AA-05 authorisations so entitlement and accountability use the same source of truth. | ||
| CIS Controls v8 | CIS-5 — Account Management | Chargeback and showback both require clear ownership of the consuming account or service. |
| Recommendation — Assign and review consuming accounts under CIS-5 so every AI workload has an accountable owner. | ||
Key terms
- AI Showback: AI showback is a visibility model that reports AI consumption to the team that used it without directly billing them. It creates an operational baseline for token usage, model choice and cost trends, which makes later accountability possible.
- AI Chargeback: AI chargeback is the practice of assigning the cost of AI usage to the internal team, product, tenant, or application that consumed it. It depends on trustworthy usage telemetry and stable ownership metadata so finance can recover costs without confusing shared consumption with shared accountability.
- Token Attribution: The process of linking model consumption to the identity, task, and permission set that produced it. When attribution is weak, finance sees spend but not cause, and security cannot connect access decisions to cost behaviour.
- Fragmentation Tax: The hidden operational and governance cost created when identity, access, and security tasks are split across too many tools. It shows up as manual reconciliation, duplicated administration, inconsistent policy enforcement, and slower response to change. The tax grows when teams rely on bespoke integrations instead of a coherent control plane.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org