AI Usage Intelligence
AI Usage Intelligence is the first item in the Discover AI sidebar group. It answers four questions: how many people use AI, which kinds of AI they use, which tools carry the most usage, and which departments use what.
The page has three tabs:
- AI Usage Intelligence: KPI cards, charts and the Departments section.
- AI Activity graph: an interactive map of people, the tools they use and the models those tools call.
- Direct provider traffic: devices and people calling AI provider APIs directly instead of through your gateway. See Direct provider traffic.
Requires an Enterprise plan and the Adoption Overview permission. Owner, Department Admin, Security & Compliance and Cost Analyst have it by default. See Members & Roles.
Where the data comes from
The page combines two sources and counts each person once:
- Discover AI clients: the browser extension and the macOS and Windows agents. See Deploying Agents & Extensions.
- Tracing OTEL: traces that coding agents and other agents send to ANTS Platform through OpenTelemetry. See Coding-Agent Telemetry.
A trace is tied to a person by the email address it carries. When that email belongs to a person enrolled in Discover AI, the trace and the endpoint activity count as the same person.
When Okta is connected through Directory Integration, each Discover AI event and trace is also stamped with the person's Okta user ID as it arrives. The ID stays the same when an email changes, so a person's history can be followed by the identity your investigators and SIEM use. See Okta user ID on records.
Filters
- Time range: Last 7 days (default), Last 15 days, Last 30 days, or a custom range.
- AI tool categories and Department. Other filters set on the AI Tools page do not apply here.
All charts bucket time in UTC. Figures can be up to about 5 minutes old because results are cached briefly.
KPI cards
| Card | What it counts |
|---|---|
| Active AI users | People who used at least one AI tool in the period, across Discover AI and Tracing OTEL, counted once per person. The subtitle splits the total into people seen through Discover AI and people seen only through Tracing OTEL. |
| AI coverage | The share of active AI users that Discover AI tracks. Example: 2 users, 1 on Discover AI and 1 only on Tracing OTEL, is 50%. People seen only through Tracing OTEL have no endpoint client installed. |
| AI sessions | Distinct times an AI tool was used across desktop apps, terminals and browsers. |
| AI interactions | Prompts sent to AI tools. Each tool uses the most accurate count available. |
| AI tokens | Tokens processed by AI tools. Taken from each tool's telemetry where available, otherwise from the agent's reading of local session files, and never counted twice. Shows No OTEL when no token data exists for the period. |
| Est. AI spend | Estimated cost based on each tool's token use. The card appears only when the period has cost data. |
What counts as active
A person is active in the period if any of these happened:
- A desktop AI app session was recorded for them.
- A command-line AI tool session was recorded in which real work happened: at least one prompt, tool call or token. A process that was seen but did nothing is not counted.
- The browser extension recorded activity on an AI tool.
- A trace with their email address arrived from a coding agent or other agent.
What counts as a session
| Surface | One session is |
|---|---|
| Desktop app | One recorded app session. |
| Command-line tool | One tool run in which real work happened (prompts, tool calls or tokens). |
| Browser | One chat or conversation in which at least one prompt was sent. Page visits alone do not count. |
| Tracing OTEL | The session ID the tool reports. It is added only where the person has no endpoint session for that tool on that day, so the same work is not counted twice. |
Trend chips
Each card shows a sparkline and a change chip. The chip compares the start of the selected range with its end: single days when the range has fewer than 14 complete days, whole weeks otherwise. Today is left out of the chip and the sparkline because it is still being collected. The headline total includes it. Active users is compared as a daily average, and coverage as a change in percentage points.
Charts
| Chart | What it shows | Views |
|---|---|---|
| AI activity trend | Sessions and tokens per day, or per week for long ranges, on two axes. | Line Chart, Bar Chart, Area Chart, Table |
| AI usage by category | Sessions grouped by tool category. Sessions from tools that matched no registry entry are listed separately so totals still add up. | Donut Chart, Bar Chart, Pie Chart, Table |
| AI tool landscape | Reach against usage intensity, per tool. | Scatter Chart, Table, Bar Chart |
| Activity heatmap | Sessions by weekday and hour (UTC). A source picker narrows it to All sources, Desktop apps, CLI tools, Browser or Agents. | Heatmap, By Weekday |
| Interaction sanction split | AI requests by the sanction status of the tool. | Donut Chart, Bar Chart, Pie Chart, Table |
| Top AI apps by users | Distinct active users per tool. | Bar Chart, Column Chart, Table |
| Top AI agents by users | Distinct users per agent, from Tracing OTEL. People without an enrolled device count here too. | Bar Chart, Column Chart, Table |
Chart view switcher
Each chart has a settings button in its top-right corner. Open it to switch the chart to another view, for example from a line chart to a table. Your choice is saved in your browser and applies the next time you open the page.
Departments
The Departments section groups usage by each person's department. The department comes from the person's device, written by the enrollment script, or from your directory through Directory Integration. Shares count sessions from desktop apps, browser, command-line tools and traced agents. Cost and tokens come from traced agents only.
The section has two views, Cards (default) and Table. Each department card shows:
- Adoption: how many enrolled people in the department used AI in the
period, for example
12 / 20. When your directory is connected, the tooltip also shows the department's headcount from the directory. - Spend: estimated cost and tokens from traced agents, in total and per person.
- Top tools: the department's most used tools. Unsanctioned tools carry a marker.
- Sessions by category: a bar of the department's sessions split by tool category.
- Sessions, Interactions and Tool calls.
When a department uses unsanctioned tools, the card shows a count. Select it to open Needs review, a list of those tools with their sessions and the departments using them. You can mark a tool Tolerated or Sanctioned from there, if you have write access to the AI Tools inventory.
Two cards collect usage that has no department:
- No department: people with no department from their device or your directory. The card links to Connect directory or Review directory sync. Users who cannot manage the organization see "Ask an organization admin to connect your directory".
- Not matched to a person: people using AI without an enrolled device, seen only through traces. Select Review to see who needs the agent. The card also lists other reasons a trace could not be matched, such as "No enrolled device for this email" or "No identity sent".
AI Activity graph
The AI Activity graph tab draws an interactive graph of Project > Users > Apps > Models. When directory data provides departments, a department tier sits between the project and the users, and people without a department are grouped under Department (unknown).
- It shows the top 10 users by default. Search by name or email to add anyone else.
- Select a user to expand their apps and models, and a tool to expand its models.
- Agents seen through Tracing OTEL appear as their own nodes, with their run counts.
Direct provider traffic
The Direct provider traffic tab lists devices and people that call AI provider APIs directly, bypassing your approved gateway and its controls, for example with a personal API key. It is for organizations that route approved AI traffic through a gateway such as Budget AI.
The report uses the network flows the macOS agent already records: connection and byte counts from each device to the AI provider API hosts listed in the registry. A device that reaches a provider's API host directly is flagged.
Each row shows the user, the device, the provider API host, the connection and byte counts, and when the traffic was last seen. Select Export CSV to download the list for security review and follow-up.
Limits. The report covers macOS devices only, because the Windows agent does not record network traffic. The stored flows do not include which process made the connection, so review a flagged device before you act. The report does not scan devices for API keys and does not integrate with secrets-scanning tools. Personal API key detection is on the roadmap.