Assign security context and cost allocation to GenAI spans

Latest Dynatrace
Tutorial
6-min read
Published Oct 12, 2026

GenAI spans carry prompts, completions, and token usage. With Dynatrace, you can tag GenAI spans to answer two of the most common questions that come up when sharing one Dynatrace environment with other teams:

Who is allowed to read the GenAI spans?
Which team pays for the observability data they produce?

Whenever possible, set these tags at the source, for example via OpenTelemetry resource attributes or OneAgent host tags.

If it's not possible to set tags at the source, or when your GenAI spans need different values than other telemetry from the same host or service, you can use OpenPipeline to set tags. This page shows you how to tag your GenAI spans to answer these questions, without changing any AI applications or their instrumentations.

Who is this for?

This tutorial is for platform and security administrators who manage OpenPipeline configurations. You don't need to change your AI applications or their instrumentation.

What will you learn?

By the end of this tutorial, you'll have an OpenPipeline configuration that processes and tags GenAI spans before they're stored in Grail.

In this tutorial, you'll learn how to:

Set security context tags on GenAI spans with the Set security context processor.
Set cost center and product tags on GenAI spans with the Cost Allocation and Product Allocation stages.
Verify the results with DQL.

OpenPipeline processes data at ingest. Therefore, you can't use OpenPipeline to modify spans that are already ingested and stored.

Before you begin

Prerequisites

GenAI spans are already being ingested into your Dynatrace environment. See AI Observability for generative AI and LLM models with Dynatrace.
You have permission to edit OpenPipeline settings.
For security context: your environment has IAM policy statements that enforce the configured security context. For more information, see Configure advanced permissions with security context.
For Cost Allocation: the cost centers and products you assign are already on the allow lists. All other values will report as unallocated. For more information, see Identify allowed cost centers and products.

Prior knowledge

You're familiar with Dynatrace tagging. For more information about the specific tags used in this tutorial, see Configure security context and Configure cost allocation.
You know how to route data to an OpenPipeline pipeline. A pipeline only processes records that a dynamic route sends to it. See Route data.

Steps

The general steps are as follows:

Create a span pipeline.
Set the security context.
Allocate costs.
Route GenAI spans to the pipeline.
Verify the results.

Create a span pipeline

Go to Settings > Process and contextualize > OpenPipeline > Spans > Pipelines.
Select Pipeline and enter a name, for example, GenAI spans.

Set the security context

The dt.security_context tag enables record-level access control in Grail. Set it on your GenAI spans to configure read access for prompts and completions.

If GenAI spans need a different context than the other telemetry from the same host or service, configure dt.security_context in OpenPipeline.

OpenPipeline routing conditions only select which spans receive that value; it isn't an isolation boundary. For per-team isolation, set dt.security_context at the source, for example in an OTel Collector you control.

In your pipeline, go to the Permission tab and select Processor > Set security context.

Configure the processor as follows.

Field	Value
Name	GenAI security context
Matching condition	`true`
Security context value	Choose Static value and enter a value that you control, for example `ai-platform` Don't derive the security context value from a field that the instrumented application sets, such as `service.name` or `gen_ai.*` attributes. A span producer could then choose the value and gain access to another team's prompts and completions. Instead, use a static value that you set.

Select Save.

Allocate costs

Cost allocation tags let you attribute GenAI costs to specific products or organizational units. To set these tags, use the Cost Allocation and Product Allocation stages in OpenPipeline.

For more information about these stages, see Cost allocation via OpenPipeline.

Allocate costs to organizational units

In your pipeline, go to the Cost Allocation stage and select Processor > DPS Cost Allocation - Cost Center.
Configure the processor as follows.

Field Value
Name
GenAI cost center
Matching condition
isNotNull(team.costcenter)
Value
Choose Field value and set the field name to team.costcenter
Select Save.

Field	Value
Name	GenAI cost center
Matching condition	`isNotNull(team.costcenter)`
Value	Choose Field value and set the field name to `team.costcenter`

Allocate costs to products

Go to the Product allocation stage and select Processor > DPS Cost Allocation - Product.
Configure the processor as follows.

Field Value
Name
GenAI product
Matching condition
true
Value
Choose Static value and enter genai-platform
Select Save.

Field	Value
Name	GenAI product
Matching condition	`true`
Value	Choose Static value and enter `genai-platform`

Route GenAI spans to the pipeline

A pipeline only processes records that a dynamic route sends to it. For details, see Route data.

Go to OpenPipeline > Spans.
Select the Dynamic routing tab.
Select Dynamic route, and configure it as follows.
- Name: GenAI span routing
- Matching condition: isNotNull(gen_ai.provider.name) or isNotNull(gen_ai.system)
- Pipeline: the pipeline you created
Select Add, then Save.
Routes are executed according to the order they appear in the list. To make sure that your new route runs before any other broader route that would also match GenAI spans, use the icon to drag-and-drop it to the correct position.

Verify the results

New GenAI spans now carry the fields that you just configured. Verify this by running the following DQL, for example in Notebooks, and analyze the output to make sure you're seeing the expected spans.

fetch spans
| filter isNotNull(gen_ai.provider.name) or isNotNull(gen_ai.system)
| fields start_time, service.name, dt.security_context, dt.cost.costcenter, dt.cost.product
| limit 20

Congratulations!

You've configured OpenPipeline to set security context and cost allocation on GenAI spans. Specifically, you learned how to:

Set dt.security_context with the Set security context processor.
Set dt.cost.costcenter and dt.cost.product in the Cost Allocation and Product allocation stages.
Route GenAI spans to the pipeline and verify the result with DQL.