Each event lands in one of three buckets. Explicit comes from X-Cg-Tag-Useror an account default — ground truth. Inferred is a probabilistic match from the ingestion-worker's attribution model when no explicit user is set. Unattributed is the gap this feature aims to shrink — no user signal at all. Inferred attribution requires nightly profile generation; new orgs spend their first day in calibration.

Users flagged when ≥—days in the window have at least one request with prompt >— tokens AND output ratio <—. Derived from prompt_tokens / completion_tokens at query time.