How would you structure usage limits across an organisation?

Nested: provider limits for the organisation; per-application limits in the gateway so one can't starve others; per-user limits against abuse and compromised accounts; per-request caps on tokens and agent steps.

Track spend daily, project the month, and act before the hard cap.