Topic starter
09/07/2026 3:17 pm
TL;DR: AI token usage is creating spend and governance blind spots that finance, IT, and security teams cannot reconcile with existing tools, according to 1Password. The real issue is not just cost tracking, but the absence of a shared control model for who can consume AI, how usage is attributed, and what gets governed.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Live Webinar Get AI spend under control: A conversation with 1Password's CFO and Advisory CISO”.
Key questions
Q: How should organisations govern AI token usage across finance, IT, and security teams?
A: They should create one accountable control model that ties consumption to an owner, a policy, and a review process.
Q: Why does AI adoption create an identity governance problem?
A: AI adoption creates an identity governance problem because the system that accesses data is often only loosely visible to IAM.
Practitioner guidance
- Define accountable AI consumption ownership Assign a business owner and control owner for AI usage so token spend can be reconciled to a responsible identity, team, or service.
- Extend approval workflows to AI access Treat AI consumption as an entitled activity with explicit approval boundaries, rather than an informal by-product of tool adoption.
- Unify finance, IT, and security reporting Create one governance view that ties consumption, cost, and authorisation together so the same activity is not measured three different ways.
Bottom line: AI token usage creates a governance gap when organisations can measure spend but cannot attribute consumption to accountable identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:35 pm
AI spend governance is now an identity governance problem, not a finance-only problem. The article describes a world where consumption is visible enough to create cost pressure but not governable enough to assign accountability cleanly. That is the classic signal that identity controls have not been extended to a new consumption layer. Practitioners should treat AI usage attribution as a governance object, not just a billing artefact.
A question worth separating out:
Q: Should organisations treat AI consumption as an access control issue or a finance issue?
A: They should treat it as both, but identity and governance should come first because spend follows authorisation. If access is not controlled, cost management becomes reactive and incomplete. The most effective programme starts with who is allowed to consume AI, then layers usage measurement and financial oversight on top.
👉 Read our full editorial: AI spend governance is the new identity control problem for teams