Written by on 2026-07-01

Token Governance for LLMs: Why Shared Budgets Fail (and How to Do It Better)

AI . Personal

Your team shares a GitHub Enterprise account. Copilot is enabled for everyone. A shared budget, no individual limits, no visibility into who consumes what: “it’s in the budget.”

Then, in mid-June 2026, GitHub switches its billing from Premium Request Units to token-based billing. Suddenly the budget is no longer “unlimited”.

The error message arrives faster than you can react:

Payment Required:
Your organization or enterprise has exceeded its Copilot budget.
Contact your admin to resume usage.

This is not an isolated case. It is happening at hundreds of companies right now.

The Problem With Shared Budgets

When everyone shares one budget, you need clarity fast: who needs how much? A few users running agentic workflows consume 500k tokens per month. Others using occasional code completion stay at 50k. Different use cases have different requirements.

The problem: in a shared budget, nobody sees where the tokens actually go. The agentic users might burn through 80 % of the total budget. Everyone else runs out and can no longer work. That is a structural problem born from missing visibility and compartmentalization – not a policy violation.

Without visibility you don’t know who consumes how much. Without limits you cannot plan how much capacity each use case is supposed to get. Result: an account that worked in June is blocked in July. And nobody knows why.

That has consequences for planning. A team estimates a feature based on “we use AI support for development”. When the tokens run out mid-sprint, the timeline collapses. The feature takes longer, the sprint plan no longer fits. You planned for availability that was never there.

The Solution: Implement Token Governance

You do not necessarily need GitHub Enterprise Plus with Advanced Budget Controls. You can build it yourself.

1. Make Metrics Visible

If you are on GitHub Enterprise, pull the metrics via the API:

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  "https://api.github.com/enterprises/YOUR_ENTERPRISE/copilot/metrics/reports/users-28-day/latest" \
  | jq -r '.download_url' \
  | xargs -I {} curl -L \
      -H "Authorization: Bearer YOUR_TOKEN" \
      {} \
  | jq -s 'sort_by(-.ai_credits_used) | .[:10] | .[] | {user: .user.login, ai_credits_used}'

The key part: you immediately see who has the highest token consumption – and that is where planning starts.

2. Build a Custom Governance Stack

If you need more control: LiteLLM + Langfuse + vLLM

  • LiteLLM (port 4000): OpenAI-compatible proxy with rate limiting per API key
  • Langfuse (port 3000): observability, tracing, exports
  • vLLM (port 8000): local inference (open-source models, if you want)

API keys in the format <host>|<user>|<tool> enable automatic user tracking. Every request is checked, traced, and limited.

From our setup (76 days, 6 users, 92M+ tokens):

  • Terminal usage: 5,348 traces
  • Code reading: 1,846 traces
  • Code execution: 958 traces

Langfuse shows us every request. LiteLLM lets us set limits.

3. Governance Strategies

For GitHub Enterprise (quick win):

  • Export weekly metric reports
  • Identify users by token consumption
  • Set separate budgets per team and use case (e.g. 100k for light users, 500k for agentic workflows)
  • Enable admin controls for spending limits

For a custom setup (robust):

  • Rate limits per user and API key (e.g. 100k tokens per day)
  • Alerts at 80 % consumption
  • Transparent dashboards (Langfuse UI)
  • Cost attribution for internal chargeback models

The Uncomfortable Truth

Token governance is an organizational problem before it is a technical one. It requires:

  • Transparency: who uses how much? And why?
  • Planning: how much budget for which teams and use cases?
  • Communication: teams know what to expect – and can plan around it

Without these decisions, availability collapses: blocked mid-sprint because the budget ran out somewhere in the company.

The companies that solved this have one thing in common: they measured early, before the bottlenecks became a surprise.

What We Have Learned

  • Visibility is the first step, not the goal
  • Shared budgets work when there are rules
  • Agentic workflows consume more tokens – that is fine if you plan for it
  • The right moment for governance is now, not later

The next wave is coming: Claude, GPT-5, open-weight models. Budgets will get more complex. Usage will get more diverse.

Whoever builds the infrastructure now keeps usage under control. Whoever waits will write budget requests in July.

Do you already have token limits in your team? How do you handle it?

Leave a Reply