Who is behind the fleet — spend, tokens, sensitive-data exposure, and risk per observed identity.

Identity here is observed, not verified — it is the telemetry identity each agent reports, which may be a vendor alias or a proxy with no human behind it. Ranked by risk, then spend.

observed identities

telemetry-attributed

$684.50

attributable spend

showback, not chargeback

critical-risk identities

max danger across owned agents

with sensitive-data opens

6 paths fleet-wide

Showback ≠ chargeback. These are observed costs attributed to a telemetry identity. Chargeback to a P&L and Team / Dept rollups need an IdP join (Okta / Entra) + SCIM — those columns below are projected.

Per-user showback

6 identities · $684.50 total · ranked by risk, then spend

Telemetry identityTokensShowbackSensitive dataRiskTeam / Dept

(proxy-only, no identity)no observed identity1.1M4% of fleet$44.103 openshigh severityCritical3 findings— unattributable via directory — projected

svc-support@qpoint.io1 agent5.6M19% of fleet$168.402 openshigh severityElevatedEngineering via directory — projected

dev-7f3@duck.comunverified alias2.4M8% of fleet$78.00estnone observedElevated1 finding— unjoined via directory — projected

mark@qpoint.io2 agents7.7M26% of fleet$245.504 openshigh severityok1 findingEngineering via directory — projected

jane@qpoint.io1 agent3.1M11% of fleet$96.20none observedokEngineering via directory — projected

svc-data@qpoint.io1 agent9.2M32% of fleet$52.30none observedok1 findingEngineering via directory — projected

Joined from costs.by_user · dlp.by_owner (sensitive opens) · risk = max(agents.danger_level) + findings per owner — all from app/data/c16-fleet.ts (qcontrol /api shape). Identity is observed, not verified.