Who is behind the fleet — spend and risk per person.

Attribute AI spend and sensitive-data exposure to the people behind the agents, so cost and risk have an owner.

Bottom line

Top exposure: (proxy-only, no identity) — $44.10, critical-risk, 3 sensitive opens. 2 identities are unverified (vendor aliases / proxy-only), which blocks accurate chargeback to a P&L.

Do nextFix 2 unverified identities →Review top spender →

observed identities

telemetry-attributed

$684.50

attributable spend

showback, not chargeback

critical-risk identities

max danger across owned agents

with sensitive-data opens

6 paths fleet-wide

Chargeback blocker

2 of 6 identities are unverified — vendor aliases or proxy-only agents with no human behind them. Until they join an IdP (Okta / Entra) + SCIM, spend and risk can't be charged back to a P&L. Team / Dept columns below are projected.

Fix 2 unverified →

Per-user showback

6 identities · $684.50 total · ranked by risk, then spend

Telemetry identityTokensShowbackSensitive dataRiskTeam / Dept

(proxy-only, no identity)top exposureno observed identity1.1M4% of fleet$44.103 openshigh severityCritical3 findings— unattributable via directory — projected

svc-support@qpoint.io1 agent5.6M19% of fleet$168.402 openshigh severityElevatedEngineering via directory — projected

dev-7f3@duck.comunverified alias2.4M8% of fleet$78.00estnone observedElevated1 finding— unjoined via directory — projected

mark@qpoint.io2 agents7.7M26% of fleet$245.504 openshigh severityok1 findingEngineering via directory — projected

jane@qpoint.io1 agent3.1M11% of fleet$96.20none observedokEngineering via directory — projected

svc-data@qpoint.io1 agent9.2M32% of fleet$52.30none observedok1 findingEngineering via directory — projected

Joined from costs.by_user · dlp.by_owner (sensitive opens) · risk = max(agents.danger_level) + findings per owner — all from app/data/c16-fleet.ts (qcontrol /api shape). Identity is observed, not verified.