Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Detection and Alerting
Track token use per user and team
Verify that token usage is tracked at granular attribution levels including per user, per session, per feature endpoint, and per team or workspace.
OWASP AISVS v1.01, requirement 12.2.5
In plain English
Track token use per user, per session, per feature and per team. Unusual consumption is often the first visible sign of abuse, a runaway agent or a stolen key. It also shows you where the money goes.
What good looks like
- Token counts are logged with user, session, feature or endpoint, and team or workspace.
- Dashboards show use at each of those levels.
- Alerts fire on unusual spikes at each level.
- Budgets or quotas exist per user and per team.
How teams usually do it
- Attribution fields in the shared log schema (12.1.3), set at the gateway.
- A separate API key or project per application and team at the provider, as a second source of attribution.
- Budget alerts and hard caps in the gateway.
Suggested evidence
- Dashboards.
- Sample alerts.
- Quota configuration.
Common mistakes
- Tracking only the monthly bill.
- One shared API key for everything, so nobody can say who used what.
- Attribution by team but not by user, so one compromised account hides in the total.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.