> _ P402 CONTROL

Plan AI spend controls before
runtime enforcement.

P402 Control lets teams design budget caps, policy boundaries, and review gates by team, workflow, model, and vendor. Runtime flip is gated until enforcement reconciliation lands.

Status: simulator live. Runtime enforcement gated.

See policy simulator Read docs

Runtime enforcement is gated. The simulator runs over historical events to show what a policy would have done.

The problem

Budgets cannot live in a spreadsheet.

Static spend caps drift. Policy intents that exist in a doc but not in the ledger never reach the call. Control gives teams a place to design, simulate, and stage AI spend policy against the same event ledger Meter records.

What Control captures

Budget cap

Cap designed and simulated against the recorded ledger.

Time window

Rolling or fixed window the cap is designed to cover.

Owner scope

Department, team, employee, or customer the policy targets.

Model scope

Models the designed policy applies to.

Vendor scope

Providers the designed policy applies to.

Workflow scope

Workflows the designed policy applies to.

Policy result

Simulator label: would approve, warn, deny, or route to review.

Review gate

Designed human review step for events that need a second pair of eyes.

Status

Draft, simulated, staged. Runtime flip remains gated.

How it works

01
Define budget and policy boundaries.
Set a cap, a time window, and the policy boundary you want to test. Designs live in the dashboard, not in runtime.
02
Pick scope: team, workflow, model, vendor.
Constrain the design to a department, workflow, model, or vendor, or any combination of the four.
03
Simulate over the historical ledger.
The simulator replays the design against recorded events and reports the would-be policy result, cost impact, and owners affected.
04
Stage the policy. Runtime enforcement remains gated.
Stage the design once the simulation looks right. The runtime flip ships when enforcement reconciliation lands.

Privacy

Simulate on economics, not content.

Control reads the same metadata-only events Meter records. The simulator runs on owner, workflow, model, vendor, and budget metadata. Prompt and response storage stay off by default.

metadata_onlyOwner, cost, tokens, budget, policy, outcome, and evidence status. No prompts. No responses. Default.
fingerprint_onlyAdds a hash fingerprint of prompt and response for dedup and replay protection. Content stays out.
redacted_tracePrompt and response retained after a redaction pass for fields the tenant policy allows.
private_gatewayYour environment hosts the inference, P402 records the economic event over a signed channel.
full_traceOpt-in. Prompts and responses retained verbatim with the event. Requires explicit tenant policy.

Read the trust posture

Proof

Same metering layer, four shipped workflows.

Each vertical demo is a working surface on the same metering layer. Use them to see the event detail, ownership attribution, policy result, and evidence status against a concrete workflow.

Healthcare

Medicaid prior authorization with HIPAA-aligned demo mode and human review gate.

Legal

M&A contract due diligence across an 8-document synthetic data room.

Real estate

Tenant application screening with fraud scoring and HUD fair-housing audit trail.

Enterprise

Department, employee, model, and workflow attribution across one organization.

For developers

Stage budget rules without touching production.

Design budget caps and policy boundaries in the dashboard. The simulator replays them against the recorded ledger and reports the would-be result on every event. Production runtime keeps running on the existing path.

Start free

For enterprise

Design AI spend policy before it ships.

Give finance, procurement, and engineering one place to design budget caps, scope rules, and review gates. The simulator shows what the policy would have done on the recorded ledger. Runtime enforcement remains gated until reconciliation lands.

Run AI Spend Audit

FAQ

Is runtime enforcement live?+

No. Runtime enforcement is gated. The policy simulator is live and runs over the historical ledger to show what a policy would have done. The runtime flip ships when enforcement reconciliation lands.

What can the simulator do?+

The simulator replays designed budget caps and policy boundaries against the recorded ledger. It reports which events would have been approved, warned, denied, or routed to review, with cost, owner, and outcome impact.

Does Control change my code?+

No. Designing and simulating policy does not touch the runtime path. Your code keeps calling the same endpoint Meter already records.

When will runtime flip ship?+

Runtime enforcement ships after the enforcement reconciliation track closes. Until then, the page surfaces simulator output only and labels gated state.

Can Control see prompts?+

No. Control reads the same metadata-only events Meter records by default. Policy decisions in the simulator use owner, workflow, model, vendor, and budget metadata, not prompt content.

What is the first step?+

Create a P402 key, send one metered event, then open the simulator and design a budget cap or policy boundary. The simulator runs over the events the ledger already holds.

Get started

Design the policy. Simulate the result.

Design a budget cap or policy boundary, run it against the recorded ledger, and stage it. Runtime enforcement ships when reconciliation lands.