AI usage, budgets & access
Seeing what your AI spend is and who drove it, capping it with budgets, and scoping which folders and secrets each agent can touch.
Three operator controls that share a theme — knowing and bounding what your agents consume and reach.
AI usage & cost#
Oversight → AI Usage gives zero-config visibility into usage and estimated cost, broken down by agent, person, team, and model.
Usage reflects real per-turn token counts read from the runtime's own session (cache-aware). Cost is real for agents run through OpenClaw and estimated for other gateways. Connected coding agents that report their own cost (Claude Code) show up here too, labeled observed and kept distinct from native metered cost; subscription tools (Codex, Cursor) have no per-turn cost, so only their activity appears.
Ceiling — Cost is estimated, not billing-grade — it's tokens against a local price table, so it misses calls without usage data and ignores prompt caching. Attribution is per-person where the initiator is known, otherwise per-agent or unattributed (agent-initiated chains, cron, and external ingress have no single human). Coverage is what damn.dev sees, not your whole AI estate. Don't reconcile a bill against it.
Budgets#
Set monthly USD caps at the workspace, team, or agent level. The most specific cap wins (agent over team over workspace).
Ceiling — Budgets apply once you've set a policy. Per-user budgets are not a hard cap — a turn's spend belongs to the agent, and per-person cost is shown for visibility, not enforced as a limit.
Per-agent access#
"What can this agent touch?" — grant specific folders (read or read/write, optionally with an expiry) and specific secrets to individual agents, from the agent's Access panel.
Ceiling — Access is default-permissive: an agent with no grants behaves exactly as before (the workspace-level scope governs). Enforcement activates per-agent / per-key only once a grant exists.
Folder grants are enforced on every install path; the strength of the underlying sandbox follows your platform (kernel-level on macOS, a physical bind on Docker), with the full per-platform detail on the Shell execution page. Secret grants are enforced everywhere — a scoped-away key fails closed, never a silent empty value — and the credential denylist is unconditional on top of all of it: a folder grant can never re-expose your keys or credential files.
Next#
- Shell execution & containment — the enforcement tiers under folder grants.
- Policy & enforcement — workspace-wide capability scope.