Context

The cost_incurred activity event exposes model names, token counts, and per-call USD costs in its description field. This data is visible to all users with OBSERVER role or above via GET /api/v1/activities.

Question

Should cost/financial data be gated behind a higher role (e.g., MANAGER/CEO) rather than OBSERVER? This is a design decision, not a code bug.

Options

1. Gate cost_incurred events behind require_write_access (manager/CEO only)
2. Strip model name and exact cost from descriptions for observer-role users
3. Keep current behavior and document that cost data is visible to observers

Source

Found during PR #832 review (security-reviewer agent).