Platform · Control
Spend is one limit. What an agent may do is the other.
Control is where governance meets the bill and the runtime. Every token allocated to a team, an agent and a purpose with a trace you can replay; budgets and anomaly alerts that fire before the invoice does; and an action plane that governs what each agent is permitted to do, with MCP tool calls treated as one unit of control alongside direct model calls.
Spend and action
Demonstration tenantBudgets alert; they do not block. A hard cutoff at call time needs a token gateway in the path, which this architecture avoids.
Control answers two questions: where is AI spend going, and what is each agent permitted to do? Cloud and vendor bills arrive at the account level, which tells you the total and nothing about which team, agent or use case produced it - and an allocation that cannot be explained loses the first argument it meets.
Today’s reality
Unattributed AI spend is a governance gap wearing a finance costume.
AI cost arrives as one line on a cloud bill. Nobody can say which team, which agent or which model produced it, so the conversation becomes a negotiation about the total rather than a decision about the parts.
The same missing attribution is a control problem. If you cannot say which agent consumed what, you cannot say which one is running away, which one is duplicated across three environments, or which one is doing work nobody asked for. Budgets alert on the number; attribution is what explains it.
What control covers
Eight things, named as the modules that do the work rather than the outcomes they promise.
Token attribution
Every token allocated at the record level - this call, this user, this agent, this model, this purpose - rather than smeared across a department average. Computed, not estimated.
Normalised across OpenAI, Azure OpenAI, Anthropic, Bedrock and Vertex.Replayable trace
Each allocated charge carries its inputs, the rule that fired and the resulting owner. You can replay exactly how any line was assigned.
The difference between trusting a dashboard and showing the math.Conflict resolution
When a cost could belong to more than one owner - a shared agent, a delegated call, a multi-tenant app - a deterministic policy decides and records why.
Defensible rather than arbitrary, which matters the moment it is challenged.Executive AI Bill
Per-team showback and chargeback, including Microsoft 365 Copilot licensing and Power Platform consumption that generate no traces for an observability tool to read.
Turns \u201cAI is expensive\u201d into a line item each owner can manage.Budgets & anomaly alerts
Ceilings per user, team, app, agent and model, with burn rate, projected month-end spend, premium-model misuse and runaway-agent detection.
Budgets alert. They do not block - see the limit below.Delegation chain attribution
Agent-to-agent calls attributed along the chain, so a budget is meaningful at any node in the tree rather than only at the entry point.
A single misconfigured agent can burn a month overnight with no human in the path.Agent Action Control Plane
What an agent may do, not only what it may spend: per-agent action policy, MCP tool calls governed alongside direct model calls as one unit.
Action limits and spend limits are the same governance problem.Enforcement coverage
Which planes are actually enforcing, how fresh each attestation is, and which controls are hard versus advisory in each plane.
An expired attestation is reported as expired, not as present.How it works
Four stages. The order matters more than the speed.
Token telemetry from your AI applications, gateways and provider monitoring, plus licensing and consumption data, normalised into one schema with one set of units.
Each usage record is resolved to a user, team, app, agent, model and purpose through a deterministic rule chain, with conflicts decided by policy and the reason recorded.
Ceilings and model-tier policies are enforced through the gateway or provider you already operate, with alerts and throttles before a breach and fallback rules that downgrade a premium model when a budget is reached.
Burn rate and projected month-end spend, so the conversation with finance is a forecast you control rather than an invoice you explain afterwards.
Make every AI dollar explainable.Token spend attributed to a user, team, agent and model, with budgets that alert rather than block.
Get my AI Exposure ScoreWhy attribution is a governance control, not a finance chore
Cost looks like a CFO topic and is usually treated as one. In an agent estate it is also the fastest signal that governance has failed.
- An unattributed line is an unowned system. If nobody can say which team caused a charge, nobody owns the agent that caused it. The spend gap and the accountability gap are the same gap seen from two directions.
- A runaway agent shows up in spend first. Loops, retries and delegation chains produce a cost signature long before they produce an incident - and on the demonstration estate, three runaway agents were visible in the token curve.
- Full cost visibility correlates with delivery. KPMG found organisations with full AI cost visibility five times more likely to report established ROI - which makes attribution the strongest argument available for funding the governance programme itself.
Know what you know — and what you do not
A governance product that produces false confidence is worse than none, because it moves risk from visible to invisible. Where a platform is not connected or a dimension cannot be measured, Govern360 reports not measured rather than assuming there is nothing there — so you can always tell the difference between measured and safe and simply not measured.
Control is usually the lowest-scoring dimension, and on the demonstration estate it is the one capping the band at 54. That is not a coincidence: attribution and action limits require decisions about ownership and purpose that most organisations have not made yet. The dimension measures attribution coverage, budget and quota posture, forecast accuracy and how much of the action plane is governed rather than merely observed.
Open full size
Read the two chips first: live and pending. The tool is invocable now, and its approval has not been recorded. Then the composition underneath - untrusted content can reach it, and it can send outside the organisation. Neither leg is unusual on its own; together, on a tool that is already live, they are the path. Both legs are configured - read out of the connector definition, not inferred from behaviour - and tool calls stay not observable, because Govern360 is not in the call path.
Where this sits in the platform
Five stages, in order. Each depends on the one before it, which is why an unconnected source weakens everything downstream rather than only its own dimension.
What this page does not claim. Budgets alert and throttle through the planes you already run; Govern360 cannot hard-stop a call at request time because it is not in the request path. Attribution covers the sources you connect - an unconnected provider reads not measured rather than zero. Figures cited here come from a connected demonstration tenant, not a customer estate.
Questions, answered
Does Govern360 sit in front of my model calls?
No. It ingests telemetry and writes enforcement actions back through the gateway or provider you already operate, so there is no new hop in your inference path and no latency budget to defend.
Can budgets hard-stop a call?
Not from here. Budgets alert and throttle through your gateway; a hard cutoff at call time requires a token gateway in the request path, which this architecture deliberately avoids. Saying otherwise would be an overclaim you would discover at the worst moment.
How is this different from my cloud provider's cost console?
Provider consoles show their own spend, in their own units, after the fact. They do not unify across providers, attribute to the agent or app that incurred the cost, or explain how a shared charge was allocated.
Can we do chargeback as well as showback?
Yes. Because every token resolves to a cost centre, you can show each team what it consumed or bill it back - and defend the allocation with the trace when somebody disputes it.
Does it cover Microsoft 365 Copilot licensing?
Yes, along with Power Platform consumption. Neither generates LLM spans, which is why observability tooling cannot see them at all - and for most enterprises they are the largest AI line.
What about agent-to-agent calls?
Attributed along the delegation chain, so cost lands with the purpose that ultimately caused it rather than the agent that happened to make the final call.
How accurate is the forecast?
It projects from measured burn rate and flags the drivers - premium-model misuse, retry loops, anomalous agents. It is a forecast, presented as one, with the inputs visible rather than a single confident figure.
What counts as a governed seat for pricing?
Pricing is per governed seat across three editions. The pricing page defines what counts as a seat and what each edition includes, rather than leaving it to a conversation.
Go deeper
The detail behind this page, in the form it is usually asked for.
The unattributed AI spend hiding in your cloud bill, and how to attribute every token.
ChecklistMicrosoft Copilot exposureTwelve checks for a Copilot Studio estate: ownership, purpose, connector operations, execution identity.
ReportAI Exposure ReportA board-ready view of AI sprawl, agent sprawl, token spend and non-human identity risk.
White paperAI Exposure Management 2026The operating model for governed enterprise AI, end to end.
Every AI dollar, owned and explainable.
Connect read-only and see where AI spend is actually going - by team, by agent, by purpose, with a trace you can replay. Thirty minutes to connect, first attribution within twenty-four hours.