Assessment · Governance · Assess and know

7Identity, access and agent permissions

Can an AI app or agent do more than it should?

Who and what can call AI, and what every agent is allowed to read, write or approve.

AutomatedStakeholder interviews 3 controls 3 engines

How we collect

  • AutomatedEntra: service principals, OAuth grants, app credentials, consent audit, roles, conditional accessRuns today
  • AutomatedAWS read-only role for AI servicesRuns today
  • Stakeholder interviewsApp owners confirm needed permissionsRuns today

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

  • Shared identities behind several agents
  • Credential ladder: managed identity to hardcoded secret
  • Blast radius: what each principal could reach versus what it did

Questions we ask

  • Which actions should this agent never take alone?

We can start from

IAM reviews, access certification results

Data sources

SourceWhat we readStatus
Microsoft Graph and Entra IDService principals, OAuth grants, app registrations, sign-ins to AI apps, Copilot usage reports. Read-only scopes, metadata only.Runs today
QuestionnaireThe short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.Runs today
AI gateway telemetryLiteLLM, Cloudflare AI Gateway or AICost CostWall logs: cost per team, workload, agent and outcome.Partly automated
Invoices, card and AP exportsAI vendors found on statements and invoices, including ones never approved. Spend is exact because it is on the statement.Partly automated

Built on governance engine modules

P7 PlannedAI Identity & Least Privilege

Does every AI identity hold only what it needs?

Security & Assurance
P2 BetaAI Security & Data Leakage

Where can data leak through AI, and what stops it?

Security & Assurance

AICost governance controls in this module

AICost-GovControl401Runs today
AI identity and least privilege
What it is

The identities AI uses (service principals, OAuth apps, API keys, agent identities), their permissions and how credentials are stored.

Why it is needed

AI often inherits more access than it needs. A shared AI account makes it impossible to tell which agent did what.

Why enterprises need it

Security teams need each agent on its own identity with only the access its purpose requires, and secrets that are not hardcoded.

What you get:Excess access removedOne identity per agentWeak credentials replaced
Run by
AI Identity and Least Privilege engineAgent Access Limits engine
Data
Microsoft Graph and Entra ID, Questionnaire
Evidence produced
Identity findings: identity, type, permissions, data reachable, credential type, expiry, finding, fix.
Maps to
NIST AI RMF: Manage; ISO/IEC 42001: access control; Zero Trust
AICost-GovControl402Runs today
Limits on what agents can do
What it is

Rules for agent actions: which tools, which data, how many steps, how much spend, which actions need a person, and a tested stop switch.

Why it is needed

Agents act, not only answer. A loop or a wrong tool call can change records or run up a bill in minutes.

Why enterprises need it

Before giving agents more autonomy, teams need hard limits that hold even when the model misbehaves.

What you get:Bounded actions and spend per runHuman approval on consequential stepsA stop switch that is tested
Run by
Agents, MCP and Autonomous Actions engineAgent Access Limits engineCost Firewall engineAgent Loop engineCost per Agent Run engine
Data
AI gateway telemetry, Microsoft Graph and Entra ID, Questionnaire
Evidence produced
Agent limits table: agent, tools allowed, data allowed, max steps, max cost per run, approval points, stop test date.
Maps to
NIST AI RMF: Manage; OWASP Top 10 for LLM: excessive agency
AICost-GovControl404Wave 2
Coding assistants and developer AI tools
What it is

Approval of coding assistants: repository access, what code is sent, retention and training settings, and seat cost.

Why it is needed

Developer tools see source code and secrets, and often arrive through individual sign-ups.

Why enterprises need it

Engineering leaders want the productivity without leaking code or paying for seats nobody uses.

What you get:Code exposure settings checkedUnused seats reclaimedApproved tools listed
Run by
Agents, MCP and Autonomous Actions engineLicense and Seat Value engineShadow AI Finder enginePlan Tier Compare engine
Data
Microsoft Graph and Entra ID, Invoices, card and AP exports, Questionnaire
Evidence produced
Developer AI table: tool, users, repos accessible, retention setting, training setting, seats paid, seats active.
Maps to
NIST AI RMF: Map; Secure development policy

Frameworks

OWASP Top 10 for LLMPrompt injection, data leakage, excessive agency, supply chain

Stakeholders

CISOIdentity teamAI platform owner
← 6. Data sensitivity, privacy and residency All modules 8. MCP servers, tools and AI supply chain →
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-18

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-18.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-18
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Anthropic Docs
2026-10-18
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 704 days captured
OpenAI
2026-10-18
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 705 days captured
Google AI
2026-10-18
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 680 days captured
Google Vertex
2026-10-18
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 680 days captured
DeepSeek
2026-10-18
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 619 days captured
xAI
2026-10-18
https://x.ai/api
Daily snapshot since Nov 2024 · 537 days captured
Mistral
2026-10-18
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 678 days captured
Cohere
2026-10-18
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Voyage AI
2026-10-18
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →