What’s the best way to set LLM budgets and visibility by team?

A gateway with RBAC is probably the cleanest fit. Sync users from your directory, assign them to teams, and set budgets either per provider or across all providers. Give each person their own credential or portal access instead of sharing a key. Directory integration also keeps team membership and access changes manageable.

We use a provider aggregator where each person gets an individual key. It supports per-user budgets, allowed-model restrictions, and weekly or monthly resets. That gives you basic guardrails and attribution without having to build a full internal system. For the most expensive frontier models, subscriptions may also be cheaper for some individual use cases, but API access is still easier to govern centrally.

If you want to evaluate alternatives, an agent or LLM gateway can also help centralize authentication and access to other AI services. The important pieces are still the same: per-user attribution, team budgets, model controls, and automatic alerts or blocking when a cap is reached.

I’d fix the shared-key issue immediately. Even with alerts, a single credential makes it hard to identify the source of an unexpected spike and increases the blast radius if it leaks. Start with separate identities, team-level caps, model allowlists, and alerts before the limit is reached. You can add more approval workflow later if you actually need it.