One customer is burning most of your AI budget. Find them, cap them.
AI cost almost never spreads evenly across your users. It follows the same power law as most usage: a small number of accounts — sometimes a single one — drives most of the spend. And your monthly total hides them perfectly. “We spent $6,000 on AI” feels like a broad problem; often it’s three users you could name.
Someone made exactly this point on one of my posts this week: a global cap fails open somewhere — it just moves the bleed to whatever the cap didn’t cover. The per-identity view is where that leak finally shows up. So let’s go find it.
Find the heavy hitters (15 minutes)
- Group spend by user or key, not just total. Your provider dashboard can break down by API key; if you tag calls per user or workflow, even better. Sort the list descending by spend.
- Look at the top. It’s almost always steeper than you expect — the top 1% of users routinely carry 30–50% or more of the cost. The shape of that list tells you whether you have a broad cost problem or a handful-of-accounts problem. It’s usually the latter.
- Note the gap between the heavy users and the median. That gap is your opportunity: fixing a few accounts moves the whole bill.
Tell power user from abuser from bug
Not every heavy user is a problem, and they need different responses. Look at how the top accounts spend:
- The power user. Steady, human-paced, genuinely using the product a lot. Not an attack — but quite possibly unprofitable at their current plan price. The fix is commercial, not technical (see below).
- The abuser. Using your AI endpoint as free inference, or hammering it from an unfamiliar source. Machine-paced, often odd hours, sometimes a leaked key that isn’t even a real customer.
- The bug. A client stuck in a retry loop, or a runaway agent calling you thousands of times. It looks like one account going vertical on a specific day.
Cap each one — without punishing everyone else
The shared fix, whatever the cause, is a per-user cap: a ceiling each identity hits on its own, so no single account can burn the whole budget. Then tailor:
- Power user → a commercial move: a usage-based tier, a higher plan, or a fair-use limit. They’re telling you your pricing doesn’t match your cost. Charge for the value they’re getting.
- Abuser → auth and quotas on the endpoint, tighter per-key limits, and rotate the key if it leaked. The per-user cap contains the damage while you do.
- Bug → the per-user cap trips it instead of letting it run all weekend, and the spike points you straight at the account to debug.
AI cost hides in a handful of accounts, not the average.
The reason the per-user cap matters most is the one from that comment: a global cap alone fails open into whatever it didn’t cover. Per-identity metering is what closes that gap — and it’s the same control that contains a leaked key, because a stolen key still hits its own ceiling no matter how valid it looks.
The takeaway
You can’t manage what the average hides. The single most useful change you can make to AI cost control is to stop looking only at the total and start looking per identity — because that’s where the money actually goes, and where the next surprise is already building.
If your AI bill looks big and vague and you want to know who is actually driving it, I can pull the per-user breakdown and set up caps that protect your margin without annoying your real customers. It’s just me, so it comes straight to me and I reply fast. Send me your setup and I’ll find who’s burning the budget and where to put the per-identity ceiling — free, within a business day.