Token governance is now central to AI ROI and agentic scale

At a glance

What this is: This is a governance analysis of why token spend erodes AI ROI, showing that inference waste, evaluation overhead, and unmonitored traces create separate cost layers.

Why it matters: It matters because IAM and AI governance teams increasingly need attribution, policy enforcement, and traceability for AI systems that behave like operational identities with real cost and risk exposure.

By the numbers:

• Enterprise LLM API spending hit $8.4 billion in the first half of 2025, showing how quickly production AI costs are scaling.
• The Soo Group documented a case where monthly AI operating costs rose from $1,500 in POC to just over $1 million in production, a 717x increase.
• In one deployment, the LLM API line item jumped from $500 to $847,293, roughly a 1,700x increase on its own.

👉 Read Fiddler's analysis of how token costs erode AI ROI

Context

Token spend is not just a billing problem. In production AI, cost growth often reflects poor attribution, excessive context use, linear evaluation overhead, and trace volumes that hide risk as well as expense. For teams governing AI systems, the question is less about cheaper inference and more about whether each call can be tied to a specific agent, workflow, or policy decision.

That matters because agentic systems create a new governance surface where model usage, trace evaluation, and downstream actions all interact. In identity terms, the AI system itself behaves like an operational workload identity: it consumes resources, invokes tools, and can generate real-world impact when controls are weak. The starting position described in the article is common in enterprise AI programmes, not exceptional.

Key questions

Q: How should security teams govern token costs in production AI systems?

A: Start with per-agent attribution so every call can be linked to a workflow, policy, or business function. Then separate inference from evaluation, set thresholds for retries and context growth, and require full trace coverage on high-risk paths. Token governance works only when cost, behaviour, and accountability are measured together.

Q: Why do agentic AI systems create hidden cost and risk exposure?

A: Because one user request can fan out into multiple model calls, evaluations, and tool invocations that are invisible in aggregated billing. That same complexity also hides unsafe behaviour, so down-sampling traces reduces assurance at the same time it trims cost. The result is a combined governance and budget problem.

Q: What do organisations get wrong about AI observability?

A: They often confuse technical telemetry with governance evidence. Dashboards can show latency, throughput, and error rates, but that does not prove the AI system stayed within approved data, policy, or accountability boundaries. Effective observability must capture the decision path, not just the system status.

Q: How do you know if AI trace sampling is creating a governance gap?

A: You know it is creating a gap when the system's highest-risk actions are covered by only a fraction of traces while cost reports still look healthy. If outputs can affect customers, compliance, or tool execution, sampled monitoring is not enough. High-risk paths need complete coverage and alerting, not statistical comfort.

Technical breakdown

Inference waste in agentic AI workloads

Inference waste is token consumption that produces no additional business value. It appears when teams use oversized models for simple tasks, ship bloated prompts, over-retrieve context, or repeat identical calls without caching. In agentic systems, this waste multiplies because one user request can fan out through several model calls, each with its own context window and output length. The architecture problem is not just model choice. It is poor workload design, weak prompt hygiene, and missing limits on retries and output growth.

Practical implication: set model-task fit rules, cap context size, and measure token use per agent and workflow rather than at the account level.

Evaluation overhead and the hidden cost of trace-based monitoring

Evaluation overhead occurs when AI outputs are checked by external LLM calls, turning every trace into another billable request. This cost scales with trace volume and number of metrics, not with output quality, which makes it easy to underestimate in pilot environments. When teams sample traces to reduce spending, they create blind spots in the very layer meant to provide assurance. The architectural issue is that monitoring can become a second consumption engine unless evaluation runs in-environment or is tightly bounded.

Practical implication: separate inference from evaluation in telemetry, and treat external evaluation calls as a governed workload with explicit cost controls.

Unmonitored traces become the incident surface

Down-sampling trace evaluation saves money but weakens governance. The uninspected majority can hide hallucinated outputs, compliance failures, and agent actions that cross policy boundaries. In practice, this is a control problem, not only a cost problem, because the same traces that drive assurance also prove whether the system stayed within authorised behaviour. Once systems act on customer data, regulated workflows, or tool access, missing trace coverage becomes a material risk exposure.

Practical implication: maintain 100 percent observability for high-risk paths and use policy-based alerts rather than broad trace sampling where decisions have external impact.

Threat narrative

Attacker objective: The objective is not theft in the classic sense but uncontrolled AI behaviour that drains budget, weakens monitoring, and increases the chance of policy-breaking outputs.

1. Entry begins when an AI workload repeatedly consumes oversized prompts, redundant retrievals, or external evaluation calls without per-call governance.
2. Escalation occurs when multi-agent loops, retries, and trace sampling blind spots expand token consumption and reduce oversight at the same time.
3. Impact is financial erosion and governance failure, because hidden spend and unmonitored behaviour can coexist with hallucinations, compliance breaches, and unsafe agent actions.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Token governance is becoming a control discipline, not a finance exercise. Once AI systems operate at production scale, the question is no longer only what they cost, but whether each token-consuming action is attributable to a specific agent, workflow, or policy choice. That puts AI observability, policy enforcement, and cost attribution into the same governance conversation. For IAM and AI security teams, the practitioner conclusion is straightforward: if you cannot attribute behaviour, you cannot govern it.

AI agents are behaving like operational identities that generate both spend and risk. The article's strongest implication is not about cheaper inference, but about the control surface created by agentic workloads. Each agent invocation, evaluation call, and tool hop creates an auditable event that should be governed like a privileged action. In a mixed AI and identity programme, this is where workload identity, policy checks, and trace integrity converge. Practitioners should treat agent behaviour as identity-relevant operational activity, not just application telemetry.

Evaluation sampling creates a hidden assurance gap that scales with usage. Sampling may reduce cost, but it also turns assurance into a probabilistic control at exactly the point where production AI needs determinism. That is why the named concept here is trace coverage debt: the growing gap between what the system does and what the organisation actually inspects. As trace volume rises, that debt compounds, and the practitioner lesson is to preserve full coverage on high-risk paths.

The market is moving toward continuous governance of AI cost and conduct. The article reflects a broader shift from one-time model selection to operational oversight across the full AI lifecycle. That shift aligns with NIST AI RMF governance expectations and with emerging agentic AI security thinking. The practitioner conclusion is to build governance that can measure usage, bound behaviour, and evidence compliance continuously, not after the bill or incident arrives.

From our research:

• Enterprise LLM API spending hit $8.4 billion in the first half of 2025, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
• For the next step: Read Guide to the Secret Sprawl Challenge to connect cost visibility with credential exposure and runtime control.

What this signals

Trace coverage debt: the longer teams rely on sampled evaluation, the more they under-inspect the very behaviours that determine AI safety, cost, and compliance. That pushes AI governance toward continuous monitoring, not periodic review, and it makes policy enforcement a runtime concern rather than a reporting one.

The operational signal for practitioners is that agentic AI spending and AI security now share the same control plane. When telemetry can attribute calls to agents, sessions, and workflows, teams gain the foundation needed to govern both budget and behaviour. For identity-led programmes, this is where workload identity, policy evaluation, and trace governance begin to intersect in a practical way.

For practitioners

• Implement per-agent token attribution Capture model, input tokens, output tokens, cost, and originating agent on every request so spend can be tied to a specific workflow or policy violation. Without that level of attribution, token optimisation is guesswork.
• Separate inference and evaluation telemetry Tag evaluation calls independently from user-facing inference calls so external monitoring costs do not disappear into one aggregated bill. Treat evaluation as a governed workload with its own budgets and thresholds.
• Set guardrails on context growth and retries Cap prompt size, retrieval volume, and repeated tool-call loops to stop runaway token burn in multi-agent workflows. Enforce thresholds before cascading retries can expand the context window.
• Preserve full trace coverage for high-risk flows Avoid sampling when outputs affect regulated decisions, customer commitments, or tool execution. Use policy-based escalation and anomaly alerts instead of assuming sampled traces are enough.
• Link AI observability to governance controls Feed token, trace, and policy-violation data into the same control plane used for access review and accountability reporting. That makes cost, behaviour, and risk visible in one operational view.

Key takeaways

• High token spend is a governance problem as much as a budget problem, because attribution determines whether AI behaviour can be controlled.
• The article's evidence shows that production AI costs can escalate by hundreds or thousands of times when usage moves from pilot to scale.
• Enterprises need per-agent observability, separate evaluation telemetry, and full coverage on high-risk traces to keep AI ROI defensible.

Key terms

• Token governance: Token governance is the control of credential lifecycle, scope, and runtime use for non-human identities. It combines inventory, issuance policy, behavioral monitoring, and revocation so that access remains limited, visible, and accountable across dynamic environments.
• Evaluation Trust Tax: The hidden cost of proving AI quality when verification depends on external model calls or repeated assessment passes. It matters because assurance can erase savings if the organisation pays too much to validate the outputs it has already generated.
• Trace Coverage Debt: Trace coverage debt is the gap between what an AI system actually does and what the organisation inspects. It grows when teams sample traces to save money, leaving the most important actions outside full review and weakening assurance over time.
• Workload Identity: The identity assigned to a software workload — such as a containerised application, serverless function, or microservice — enabling it to authenticate to other services without storing static credentials.

What's in the full article

Fiddler's full blog post covers the operational detail this post intentionally leaves for the source:

• Per-call telemetry patterns for capturing model, token, latency, and estimated cost at the agent level.
• The practical differences between inference spend, evaluation spend, and hidden monitoring overhead.
• Example instrumentation code for tracking token usage across OpenAI-compatible responses.
• The specific failure modes that make context inflation, retries, and sampling more expensive in production than in pilot environments.

👉 Fiddler's full post covers the telemetry model, cost attribution patterns, and sampling trade-offs in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It is designed for practitioners who need to connect identity control to operational AI risk.