# Catch spend drift before the invoice does

> Run a regular usage review in Agent Router so slow cost creep, a chatty agent, or a drifting workload is caught in weeks, not on the monthly invoice.

Enterprise Tier

  Hard limits stop catastrophes; they do not catch the slower drifts. An agent framework that starts making ten calls where a human would have made one stays comfortably under every rate limit while it doubles the bill. The control for drift is observation on a cadence: a usage review short enough to be sustainable and regular enough that a surprise is at most a week or two old when it surfaces.

**Persona:** Platform operator working in the Admin Dashboard.

**Estimated time:** 10 to 15 minutes per review; weekly is typical, daily for environments with high turnover.

## Outcomes

By the end of this guide:

- Usage Analytics is read on a regular cadence, with per-key attribution as the unit of analysis.
- The by-key, by-user, by-model, and by-provider breakdowns are each mapped to the question they answer.
- Anomalies found in the review have a follow-up path: drill-down, the audit trail, or the owning team.

## Prerequisites

- Administrator access to the Admin Dashboard: typically the `super_admin` or `billing_admin` role.
- API keys that follow the per-purpose convention established in [Onboard developers and issue keys](/agent-router-enterprise/guides/operate-and-govern/onboard-developers-and-issue-keys). A single organization-wide key that everyone uses makes per-purpose attribution effectively impossible.

## Step 1: Run the review on a cadence

1. Open **Usage → Analytics** in the Admin Dashboard on a regular cadence: weekly is typical, daily for environments with high turnover.
1. Apply a time range that matches the budgeting cadence (last 7 days, last 30 days, last billing cycle).
1. Switch to the **By API Key** breakdown.
1. Sort by cost descending.
1. Review the top consumers. The shape of the list should match the operator's mental model of Agent Router; surprises in this view are the most common signal that something is worth investigating.

## Step 2: Read the breakdowns against their questions

The breakdowns by user, by model, and by provider all support the same workflow at different levels of aggregation. **By User** answers "which team is spending the most"; **By Provider** answers "which contract is bearing the load"; **By Model** answers "which models are doing the actual work". A row that moved sharply between reviews is the drift signal this guide exists to catch: drill into the row to see the keys, models, and costs behind it, then take the finding to the owning team.

To compare several people or teams side by side on the same chart, use the multi-select **User** and **Team** filters described in [Compare user and team spend in Analytics](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/compare-user-and-team-spend-in-analytics).

Both units of measure matter, and they answer different questions. Token totals describe the workload, how much a consumer is actually asking the models to do, and are stable across pricing changes. Cost translates that workload into money and is the unit finance thinks in.

## Step 3: Route findings to the right follow-up

- A drift with a legitimate cause (a feature launch, a new team onboarded) feeds the next budget conversation; the ceilings are adjusted in [Raise a spend ceiling without interrupting delivery](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/raise-a-spend-ceiling).
- A drift with no known cause is investigated through the audit trail: the spot-the-anomaly-then-find-the-cause workflow in [Audit Agent Router activity](/agent-router-enterprise/guides/operate-and-govern/audit-platform-activity) traces a spend change back to the configuration or key event behind it.
- A runaway in progress, rather than a drift, is an incident: see [Contain a leaked key before it drains the budget](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/contain-a-leaked-key).

For longer-horizon reporting (chargeback statements, quarterly reviews, or compliance attestations), the Export function returns the underlying data as CSV; the reporting workflow is covered in [Bill AI spend back to the teams that incur it](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/bill-ai-spend-back-to-teams). For always-on visibility with alerting instead of a manual cadence, see [Get alerted to cost spikes as they happen](/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/get-alerted-to-cost-spikes).

Where to go next

  <Link to="/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/get-alerted-to-cost-spikes" className="tare-nav-card">
    Get alerted to cost spikes as they happen
    Replace dashboard-watching with alert rules in the observability stack.
  </Link>
  <Link to="/agent-router-enterprise/guides/operate-and-govern/cost-and-quota-management/keep-team-spend-inside-a-ceiling" className="tare-nav-card">
    Keep each team's spend inside an agreed ceiling
    Turn the baselines read here into budgets that track spend and alert.
  </Link>