AI spend under administrative control. Per department. Per user. Per model.
Budgets, rate limits, and model allowlists resolve in memory before a single token goes upstream. A denied call costs you nothing — and still lands in the audit log.
Three departments. Three policies. One gateway.
Marketing reaches every model — including Kimi 3 in an untrusted region. Engineering is pinned to trusted providers. EU Finance is pinned to EU-region models. Watch the gateway allow, block, and log every decision.
Marketing · allowlist: all models
Low-sensitivity work — copy drafts, ideation, public content. Reaches every model in the catalog, including Kimi 3 and DeepSeek in untrusted regions. Every call still budgeted and signed into the event log.
Engineering · trusted providers only
Source code and internal docs stay on trusted providers. A call to an untrusted-region model is denied at the gateway — 403 model_not_allowed — before a single token leaves.
EU Finance · EU-region only
Regulated data stays in-region by policy: EU Finance reaches only EU-hosted models. Denied calls cost nothing — and still write exactly one HMAC-signed event row to the audit log.
Customer → Department → User → Virtual Key.
Every scope can carry its own budget matrix: USD and token limits, per model. A NULL model means a blanket limit; an absent row means unlimited. The most specific applicable limit wins.
The per-model budget matrix
Cory can burn 1M tokens a month on Opus and run unlimited on GLM — same user, two rows. Deduction is cumulative across the hierarchy, and any breach returns 402 budget_exceeded with structured detail: level, dimension, model, used, limit, and reset_at. The caller knows exactly which limit bit them and when it clears.
Model allowlists are a compliance control, not a convenience.
Restrict which models each scope may touch — by alias and by upstream model ID — and the gateway enforces it before the request leaves.
EU team → EU-hosted models
Bind a department to the models that satisfy its data-residency obligations. Anything outside the allowlist is a denied call with a blocked event row — not a leaked prompt.
Intersection semantics
Allowlists compose most-specific-scope-wins with intersection: the effective set is what every applicable scope permits. An explicit deny-all row means exactly that — no models, no exceptions.
Alias + upstream matching
Rules match both the alias the app called and the upstream model it resolves to — so renaming an alias can't smuggle a restricted model past the policy.
Rate limits, enforced pre-upstream
Token and request rate limits run on a sliding window, estimated from max_tokens plus the prompt — before the call reaches the provider. An over-limit request is a 429 from Trifrost, not a bill from your vendor.
50+ concurrent, no races
Check-and-deduct is atomic in the in-memory cache — no TOCTOU window where two concurrent requests both sneak under the limit. If the governance cache is unavailable, the gateway fails closed with a 503, and admins can evict the cache on demand.
Know what a coding session cost. Not just a call.
Per-request cost tells you what one API call burned. Trifrost maps the many inference calls of a session — chat turns, tool loops, retries, hidden title-generation calls — into one roll-up: this session cost $4.32, with a per-turn breakdown underneath.
- Session roll-up — dozens of calls, one attributable number
- Per-turn breakdown — every turn itemized with tokens and cost
- Utility calls included — even hidden system calls surface in the breakdown
Pricing is data. Spend is provable.
Dual cost tracking
Upstream provider cost and your markup tracked side by side on every request — so internal chargeback reflects what you charge, and reconciliation reflects what you paid.
Custom pricing overrides
Set pricing per virtual key, team, or customer. Contract rates and internal transfer prices live in Trifrost, not in a spreadsheet.
Pricing snapshots
Spend is priced against the snapshot that was live at the time. When a vendor reprices, historical spend recalculates against historical pricing — your past numbers stay defensible.
Forecast with confidence bounds
Holt's exponential smoothing projects spend with a 95% confidence interval, a budget-exhaustion date, and anomaly detection for the days that don't fit the trend.
Spend alerts
Threshold rules with cooldowns fire before budgets blow out — and every alert lands in the audit trail, so you can prove who was warned and when.
Analytics & export
Spend by provider, model, department, user, or key. Cost and token histograms, model usage rankings, and CSV/JSON export for the finance stack.
Zero DB hits on the hot path
Budget and rate-limit checks resolve against an in-memory cache — no database round-trip stands between your request and the provider. The cache survives admin writes, check-and-deduct is atomic, and if it ever becomes unavailable the gateway fails closed with a 503 rather than letting ungoverned spend through.
Run the hierarchy from the console.
Create departments, set per-model budgets, and tune allowlists from the dashboard. Every mutation is RBAC-checked, org-scoped, and written to the audit log — governance changes are themselves governed.
How admin access is secured →