Governance & Cost Control

AgentWatch’s governance model treats AI spend and AI access as things to be controlled, not merely reported. The distinction matters: a monthly report tells you what already happened, while an enforced budget stops it.

How do budgets work?

Budgets apply at four tiers — organization, team, tenant, and individual user API key — with independent daily and monthly limits at each level, and the strictest applicable limit wins.

Enforcement is real: when a budget is exceeded the gateway rejects the request with a payment-required response rather than letting spend continue. Alongside that:

• Threshold alerts fire by webhook and email at 80%, 90%, and 100% of each tier’s daily and monthly budget, with configurable recipients per tier.
• Admin overrides carry an expiry — extra headroom can be granted for a known launch or migration without anyone having to remember to revoke it.
• Efficiency leaderboards rank teams by tokens-per-dollar and month-over-month spend trend, which is what makes FinOps review of AI usage possible at all.

What can be rate-limited?

Every dimension the gateway can see: per model, per user, per team, per organization, per API key, per application, per MCP server, and per individual tool. On breach, the configured behavior is selectable per scope — fall through to the next-priority provider, return a 429 with a retry-after, or raise a webhook or email alert. Concurrency caps, queue depth, and queue timeouts are configurable so a burst is absorbed rather than turned into failures.

Can spend be attributed to individual employees?

Yes, and each employee is a first-class identity rather than a tag on a log line. Per employee, AgentWatch supports:

• A profile with department, team, role, and status.
• A scoped API key inheriting the organization’s model access, budget, and DLP policy.
• Personal daily and monthly budgets applied as a stricter cap than the team’s.
• Pause and resume of access — for a departure, suspension, or investigation — without destroying the audit trail.
• Forced key rotation with email notification and an overlap window.
• CSV bulk import so hundreds of employees can be onboarded from an HR export.
• Automatic task categorization, classifying each request into Code, Content, Data Analysis, or a custom category — which is how a report can answer “how much of last quarter’s AI spend went to code generation versus marketing copy?”

How is chargeback handled?

Every request records tokens, cost, duration, model, provider, team, user, and session, so spend rolls up along any of those dimensions for internal chargeback or showback. Reports export from the UI and programmatically for finance systems, and cached-token counts are surfaced separately so savings from prompt caching are visible rather than hidden in a lower total.

Is AgentWatch multi-tenant?

Natively. Each organization is a fully isolated tenant — providers, keys, model catalogs, employees, teams, budgets, DLP policies, audit trails, and analytics are all tenant-scoped at the data layer, with no cross-organization access path. A platform-level super administrator can see across organizations; an organization administrator sees only their own. The hierarchy runs organization → teams → tenants/users → model access and API keys, with per-tenant rate limits, token limits, budgets, suspension, and feature flags.

This isolation model is what makes AgentWatch deployable not just internally but as a governed AI gateway offered to others — by ISVs, managed service providers, or a holding company serving its operating units.

Can models be restricted per team?

Yes. Administrators provision which models are exposed to which teams and tenants, in bulk if needed, and can alias models per organization for governance naming. A model can be disabled to retire it without breaking applications that still reference it.

Sources and references

• Where the gateway enforces these controls: LLM gateway and routing.
• Reporting and analytics: Observability and insights.