Notifications
Clear all
Topic starter
09/07/2026 3:17 pm
TL;DR: AI token usage is creating spend and governance blind spots that finance, IT, and security teams cannot reconcile with existing tools, according to 1Password. The real issue is not just cost tracking, but the absence of a shared control model for who can consume AI, how usage is attributed, and what gets governed.
NHIMG editorial — here’s why we think this discussion matters
Questions worth separating out
Q: How should teams govern AI consumption when spend is spread across multiple tools?
A: Start by assigning one control owner for AI consumption governance and require shared evidence from finance, IT, and security.
Q: Why do existing IAM tools miss AI spend and usage risk?
A: Most IAM controls can show whether an identity can access an AI-enabled service, but they do not always show token consumption, workflow context, or whether the use was expected.
Practitioner guidance
- Define AI consumption ownership across teams Assign a named control owner for AI spend governance and document how finance, IT, and security each contribute evidence for usage approval, attribution, and exception handling.
- Map AI usage to accountable identities Tie AI consumption reporting to the user, service account, or workflow that generated the activity so spend can be traced back to an accountable identity.
- Review whether existing tools capture consumption telemetry Check whether your current IAM, SaaS, and monitoring stack records token usage at the level of identity, application, and workflow rather than only login events.
What to expect at the briefing
1Password's full webinar covers the operational detail this post intentionally leaves for the source:
- Live discussion with the CFO and advisory CISO on how finance and security should share ownership of AI spend oversight.
- Practical examples of the AI consumption questions leaders should be able to answer before usage scales further.
- The alternate session option for teams that need to join in a different time zone.
- A candid conversation about how 1Password is approaching AI governance and spend control.
👉 Register for 1Password's live webinar on AI spend and governance →
AI token usage and governance gaps: what should teams do now?
Explore further
09/07/2026 3:35 pm
AI spend governance is now an identity governance problem, not just a finance problem. When AI consumption is spread across multiple tools, the organisation loses a consistent view of who is using what, under which authority, and for which business purpose. That is a classic governance failure because the same identity can drive both legitimate work and uncontrolled consumption. Practitioners should treat AI usage as an entitlement and attribution problem first, then a cost problem second.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How can organisations tell whether AI consumption is actually under control?
A: Look for three signals: usage tied to accountable identities, clear approval paths for exceptions, and reporting that separates normal workflow consumption from unexpected spikes. If those three signals are missing, the organisation may be paying for AI without governing it. The real test is whether usage can be explained, not just billed.
👉 Read our full editorial: AI spend governance is the new identity control problem for teams
