Free tool · SaaS AI governance · Agent spend optimization
AI Agent Permission Audit & Shadow-Spend Calculator
For CTOs and finance leads: map the API keys your agents hold against what they actually do, see how much permission is excess, and estimate the shadow spend sitting in unused and over-privileged keys. Everything runs in your browser; no input leaves your device.
Permission & shadow-spend audit
How many distinct agents or agent services are live today.
Average keys, tokens, and service accounts each agent can use — model providers, SaaS tools, databases, payment and messaging APIs.
Your own number from billing — model tokens plus the SaaS tools the agent calls. This tool invents no benchmarks; every dollar figure below is arithmetic on your inputs.
Share of keys that can change data, delete records, send messages, or move money — not just read.
From your provider consoles or activity logs: keys with no calls in 30 days are dormant — they still carry their permissions.
Could you answer, for one key, exactly which agent used it, when, and to do what?
Audit Summary
Shareable ROI report
Copy this report for your CTO / finance review, or use Download PDF to print / save it. It states the formula used, so anyone can re-run your numbers.
How the numbers work
Total keys = agents × keys per agent. Shadow spend is the slice of your monthly spend attributable to dormant keys: total monthly spend × dormant-key share. That is spend capacity provisioned to keys nobody used — the first place to cut, and the first place an auditor will look. Permission risk rises with the share of keys holding write, delete, or payment power and falls as per-key logging improves: an over-privileged key you cannot trace is exposure without evidence.
The audit order that works: inventory every key per agent, revoke dormant keys, downgrade write keys to the narrowest scope the agent's logged activity proves it needs, split shared keys so every call maps to one agent, and put a monthly per-key spend ceiling in place so a single key cannot silently become the budget.
This is an informational self-assessment based only on the numbers you enter — not a security audit and not financial advice. Verify key usage in your providers' own consoles before revoking anything a production agent may still need.
FAQ
What is shadow spend for AI agents?
Here it means spend capacity tied to dormant or forgotten API keys — provisioned, permissioned, and billable, but unused in the last 30 days. It is calculated only from your own spend and dormant-share inputs.
Does my input leave my device?
No. The calculator runs entirely in your browser, and the PDF is generated by your browser's print function.
Why does permission breadth matter if spend is low?
Spend measures cost; permissions measure blast radius. A low-spend key with delete or payment power can still cause the expensive incident — the audit scores both, separately.
Get the $29 Governed Agent Mesh Playbook to fix the audit findings
The Playbook — Studio Edition gives you the permission-tiering patterns, approval gates, per-key spend ceilings, audit-trail templates, and incident runbook behind every fix in your report.
Get the Studio Edition — $29