AgentLedger

Documentation ยท Access

Give auditors access to AI agent spend

The dashboard is an admin tool for auditing AI usage. Grant it through a named role so access is reviewable and ACCOUNTADMIN stays out of daily use.

Why a dedicated role

The dashboard shows developers' prompts, replies and tool details, and it changes settings. Granting it directly to ACCOUNTADMIN, or to a shared team role, means the ability to read prompts is invisible in access reviews. A named auditor role fixes that.

Create the role

CREATE ROLE IF NOT EXISTS AI_USAGE_AUDITOR;
      GRANT APPLICATION ROLE AGENTLEDGER.APP_ADMIN TO ROLE AI_USAGE_AUDITOR;
      GRANT ROLE AI_USAGE_AUDITOR TO USER <auditor>;

      -- Optional: the cost and session views in SQL, without prompts
      GRANT APPLICATION ROLE AGENTLEDGER.APP_VIEWER TO ROLE <analyst_role>;

APP_ADMIN can open the dashboard, read traces and change settings. APP_VIEWER can query the cost and session views in SQL but cannot read prompts.

Use it in reviews

  • Access to AI usage is now a single grant with a clear name, so it can be listed in SOX and SOC 2 control evidence.
  • Prompts stay readable only through this role, and only when someone opens a session's trace.
  • Agent spend is calculated where your financial auditors already look, under the same Snowflake agreements.

Next steps