c16
c16 / wf5.m1 - Agent Control Plane — hi-fi (wf5.m1) / Showback·control-plane-v1/showback·draft

Finance · Showback by User

Only 82% of spend has an owner you could bill — $122.10 has none

Owner rollup →

$684.50 in observed AI spend. $562.40 (82%) maps to a verified owner you could charge back; $122.10 (18%) does not — 2 of 6 identities are unverified (vendor aliases like duck.com or proxy-only agents with no human behind them). Top exposure isn't the biggest bill: (proxy-only, no identity) at $44.10 (critical-risk, 3 sensitive opens).

Observed, not verified — the table is ranked by risk weight first, then spend. Chargeback figures are projected, not billed.

Observed spend

$684.50incl. est.

across 6 identities · 11% estimated

Unchargeable liability

$122.10

18% of spend · no verifiable owner

Chargeback-ready

82%

$562.40 on verified owners · projected

Critical-risk identities

1of 6

3 with sensitive-data opens

How much spend can land on an owner

$684.50 observed total
▲ 82% chargeback-ready
Verified owner — chargeable (projected) $562.40
Unverified — no chargeable owner $122.10

2 of 6 identities carry $122.10 with no owner to bill — vendor aliases like duck.com and proxy-only agents. Resolve them to convert this liability into chargeback.

By attribution status

$684.50 total
18%unchargeable
Verified — chargeable$562.40
Unverified — liability$122.10

Observed identity, not IdP-verified. Chargeback needs a verified, deprovisionable owner.

Per-user showback — ranked by risk, then spend

6 identities · $684.50 total

Ranked risk-weight first, then spend — a small-spend Critical identity outranks a big spender, because the biggest bill is rarely the biggest exposure. Unverified rows have no chargeable owner and are flagged.

Telemetry identity
Risk · weight
Tokens
Sensitive opens
Chargeable to
Showback
(proxy-only, no identity) top exposure no observed identity Critical ×3 weight · 3 findings1.1M4% of fleet3 openshigh severity unchargeable no identity$44.10
svc-support@qpoint.io1 agent Elevated ×2 weight5.6M19% of fleet2 openshigh severityEngineeringvia directory · projected$168.40
dev-7f3@duck.com unverified alias Elevated ×2 weight · 1 finding2.4M8% of fleetnone observed unchargeable unjoined alias$78.00
est
mark@qpoint.io2 agents Standard ×1 weight · 1 finding7.7M26% of fleet4 openshigh severityEngineeringvia directory · projected$245.50
jane@qpoint.io1 agent Standard ×1 weight3.1M11% of fleetnone observedEngineeringvia directory · projected$96.20
svc-data@qpoint.io1 agent Standard ×1 weight · 1 finding9.2M32% of fleetnone observedEngineeringvia directory · projected$52.30

Joined from costs.by_user (spend, tokens) · dlp.by_owner (sensitive opens) · risk weight = max(agents.danger_level) rank + findings per owner. Identity is observed, not verified; duck.com is an unverified vendor alias. Showback is attribution, not chargeback — chargeback figures are projected and need an IdP-verified owner.

Do next