As a workspace Admin, I want to prevent unexpected API costs from unrestricted usage of AI Functions (AI_QUERY() etc.), how can we control that only a particular group-users can execute AI Functions ?

I understand the function execution cost can be viewed from https://docs.databricks.com/aws/en/large-language-models/ai-functions#-view-costs-for-ai-function-wo... but perhaps it will be too late 😉

Best Practice and guidelines pls.