How can we see who is using which AI models?

Summary

• Unity Gateway records requests to model services, model provider services and MCP services in the system.ai_gateway.usage system table (Public Preview), including requester, model, token counts, status and latency.
• Admins can create a built-in usage dashboard with overview, performance, usage, cost, MCP and coding-agent views, and can share it without granting access to the underlying tables.
• Attribute usage to teams and projects with service tags, set once on a model service, or request tags, set per request by the caller.
• Cost for Databricks-hosted models comes from billing usage records, which you can convert to list-price dollars. External provider spend comes from an estimates table (Beta) that can differ from the provider's invoice.
• Optional inference tables store request and response payloads, and audit logs show who accessed which AI service and when.

How can we see who is using which AI models?

Route model traffic through Unity Gateway, then read the usage records. Each request that passes through a model service, model provider service or MCP service is recorded. Model requests carry the requester, the model that handled them and token counts. You can query those records in SQL, view them on a built-in dashboard, or join them with billing data for cost.

Why is usage hard to see without a gateway?

When applications call model APIs directly, there is no single record of who called which model. The Unity Gateway observability docs frame the problem the same way: as teams adopt coding agents, copilots and custom agents, it gets harder to see who accesses which models or tools, how much they cost, and whether endpoints are healthy. Because every request routes through the gateway, those questions can be answered in one place.

What does Unity Gateway record?

The usage table is system.ai_gateway.usage, which is in Public Preview and has a free retention period of 365 days. Key columns:

Question	Column in system.ai_gateway.usage
Who made the request?	requester and requester_type
Which model answered?	destination_model, destination_name and service_name
How much was used?	input_tokens, output_tokens and total_tokens
Did it succeed, and how fast?	status_code, latency_ms and time_to_first_byte_ms
Which team or project?	endpoint_tags (service tags) and request_tags
Which coding agent?	session_metadata.coding_agent and session_metadata.agent_version
Which tool was called?	mcp_metadata.tool_name, for MCP_SERVICE rows

Both account and metastore admin roles are required to query the table by default, though admins can manage access to system tables. This query, built from those columns, shows token use by requester and model over the last week:

SELECT requester, destination_model, SUM(total_tokens) AS total_tokens
FROM system.ai_gateway.usage
WHERE event_time >= CURRENT_TIMESTAMP - INTERVAL 7 DAY
GROUP BY requester, destination_model
ORDER BY total_tokens DESC;

How do you share it without granting table access?

An account admin can create the built-in usage dashboard from the Unity Gateway page, and the docs note that admins can publish it to share usage analysis without granting table access. Its tabs cover overall activity and top users, performance and error rates, consumption by model service, workspace and requester, cost, external MCP server traffic, and coding agents. Account and workspace admins can also see an AI usage overview in Governance Hub.

How do you attribute usage to teams and projects?

Use service tags when each team or project has its own model service: the tag applies to every request through that service, so you set it once. Use request tags when teams share a service: the caller sets them per request in the Databricks-Ai-Gateway-Request-Tags HTTP header. Service tags appear in endpoint_tags, request tags appear in request_tags, and you can group usage by either.

How do you see cost and payloads?

• Cost: for Databricks-hosted models, cost attribution uses the billing usage system table. For external providers, the external model spend system table (Beta) holds estimates based on each provider's published prices, so they can differ from the final invoice.
• Payloads: inference tables log raw request and response payloads to a Unity Catalog table, and they follow standard Unity Catalog permissions. Payloads above 10 MiB are not logged.
• Access: query system.access.audit to see who accessed which AI service and when, and use run_by and run_as in identity_metadata to tell a human caller from an agent acting for them.

FAQs

Can we alert on unusual usage?

Budgets send alert emails when monthly spend crosses a threshold. For other conditions, Databricks SQL alerts monitor any SQL query result on a schedule, so you can write one over the usage table.

Does it cover tools as well as models?

Yes. Usage tracking also captures MCP service requests. For MCP rows, mcp_metadata.tool_name identifies the tool that was invoked.

How do we keep sensitive data out of requests?

The Sensitive Data Detection service policy (Beta) detects structured data such as Social Security numbers and credit card numbers and either blocks the interaction or redacts the matched values. Inference tables can then help you verify that the guardrail works.

Is usage tracking free?

No. Usage tracking and inference tables are billed Unity Gateway features, so check Unity Gateway pricing before enabling them broadly.