AI spend with an approval trail. Every change owned, approved and logged.
Audon reads OpenAI, Anthropic and xAI (Grok) cost data with a key used read-only, attributes it to the projects and workspaces you map to desks and cost centres, and records every finding, approval and experiment in a hash-chained activity log.
Free 30-day audit. Read access only, no card.
Observed spend
$37,112.28
30 of 30 days
Findings
4
1 anomaly to review
Largest workspace
64.9%
cc-4120-kyc-ops
Verified savings
$2,642.39
1 approved experiment
- cc-4120-kyc-ops64.9%$24,118.60
- cc-3300-client-service21.2%$7,904.33
- cc-2210-research8.8%$3,266.95
- cc-5100-model-sandbox4.9%$1,822.40
Mapped as one workspace per desk or cost centre.
Cost control in a regulated firm is a governance problem. Ownership, approval and evidence, in that order.
Budget ownership per desk and cost centre
AI spend lands on one central technology line. Desks consume it, nobody owns it, and chargeback is a spreadsheet at quarter end.
Map each desk or cost centre to an OpenAI project or Anthropic workspace and spend is broken down daily. The budget burn detector projects month-to-date spend against your monthly budget, and monthly spend alerts reach the owner before it’s exceeded.
- Breakdown by project, workspace and model
- budget_burn
- Monthly spend alerts
Approval trails for cost changes
Switching a model or capping retries on a client-facing agent is a change. Change management wants to know who proposed it, who approved it and what evidence they saw.
Optimization proposals need approval by a second person; the proposer can’t approve their own change. Every note, approval, experiment and result is written to a hash-chained activity log that you can export.
- Verification workflow
- Hash-chained activity log
- Report and data export
Model-risk review wants evidence, not dashboards
The second line asks how a cost figure was produced, from which data, and whether someone else would get the same answer.
Each finding records its detector and version, baseline, assumptions, confidence and the provider records behind it. Each audit records a snapshot hash of the data it analysed. Detectors are deterministic: the same snapshot gives the same findings.
- Detector versions and snapshot hash
- Evidence class on every amount
- Report and data export
Least-privilege access for finance and audit
Finance needs to see spend, internal audit needs to read everything, and neither should be able to change connections or approve experiments.
Roles include owner, admin, analyst, billing_admin and read_only. API and MCP access uses scoped OAuth, intersected with the person’s role, so an agent never has more access than the person who connected it.
- Roles
- REST API and MCP
What the audit committee would see. Every amount with its class and its source.
- FND-0518Medium
On track to exceed the October budget
Observed spend$2,349.36 projected over budget$30,926.90 after 25 full days; straight-line projection $38,349.36 against $36,000.00
- FND-0519Info
64.9% of attributed spend is on workspace cc-4120-kyc-ops
Observed spend$24,118.60 workspace totalShare of attributed spend over 30 days · 4 workspaces with attribution
- FND-0520Medium
Spend spike on workspace cc-2210-research
Anomalous spend$327.08 above median12–13 Oct at 2.8× and 2.6× the trailing 14-day median · 58 cost records
- FND-0521Info
No outcome data: cost per successful task is unknown
Observed spendUnavailable cost per success$37,112.28 of spend with no matching outcome telemetry
FND-0518
On track to exceed the October budget
- Classification
- Observed spend
- Amount
- $2,349.36 projected over budget
- Detector
- budget_burn 1.0.0
- Status
- Open
Detected by scheduled audit26 Oct
Projected $2,349.36 over the October budget.Note from FP&A26 Oct
KYC operations (cc-4120) carries 64.9% of attributed spend. Budget owner informed.Monthly spend alert created26 Oct
Above $32,400.00 (90% of budget), to the finance distribution list.
Synthetic example: generated for this page, not a customer result. Anomalous and observed amounts are not savings, potential savings are not validated, and nothing becomes a verified saving without an approved experiment.
What changes for each role. Same data, three different questions answered.
Finance and FP&A
billing_adminToday
Allocates one AI invoice to desks by headcount at quarter end.
With Audon
- Spend per desk and cost centre, daily
- Budget burn projected before month end
- Exports for chargeback and accruals
Technology risk and audit
read_onlyToday
Reconstructs who approved a model change from emails and tickets.
With Audon
- Second-person approval on every change
- Read access without the power to change anything
- Detector versions and snapshot hashes per audit
Desk or platform owner
analystToday
Is asked to cut AI cost without a way to show what a change saved.
With Audon
- Their workspace’s spend and findings, daily
- Proposals with rollback plans
- Savings verified by experiment, not estimated
Your first audit takes about fifteen minutes. Thirty days of real spend, read-only.
About 2 minutes
Connect a key (read access only)
Paste an OpenAI organization admin key, an Anthropic Admin API key or an xAI management key. We validate it against the cost and usage endpoints before saving it, encrypted.
Usually under 10 minutes
Import and reconcile 30 days
Daily cost records by project, workspace and model, reconciled against what is already stored. Recent days stay provisional until the provider finalises them.
Detectors run in seconds
Read the report
Six versioned detectors run on a hashed snapshot. You get an executive summary, coverage, spend profile, findings with evidence, next steps and the method.
How it supports your controls. Stated carefully, because your auditors will read it.
Segregation of duties
The person who proposes an optimization can’t approve it, and results are verified by people other than those who recorded them. Roles separate billing, analysis and read-only review.
An activity log you can test
Every material action is written to an activity log with a hash chain, so gaps or edits are detectable. It is included in data export.
Data minimisation
Connectors read cost and usage aggregates only: no prompts, no completions, no client data. Telemetry rejects metadata keys that look like content or personal data.
Out of the inference path
An admin key used read-only, encrypted with AES-256-GCM, never shown again and revocable at the provider. Audon can’t change your agents or routing.
Audon is a tool that can support your controls. It doesn’t make you compliant with any regulation, framework or supervisory expectation, and we hold no SOC 2 or ISO 27001 certification. Data is not stored in the UAE or KSA; check this against your outsourcing and data-location requirements. Nothing on this page is legal advice. Read the security overview and privacy policy for the details.
Questions financial services firms ask before connecting.
Is Audon certified for financial services?
Can we attribute spend to cost centres?
How is approval enforced?
Can internal audit get access without changing anything?
Where is our data stored?
Does the free audit need a contract?
Give every AI cost an owner and a trail. Start with a free audit of last month.
Free 30-day audit. Read access only, no card, revoke any time.