PRODUCT · GOVERNED AI ACCESS

The control plane for governed AI model access

AIMS sits in front of your OpenAI-compatible gateway, controls who can use which models, issues short-lived scoped keys, and attributes every token and every pound to org, project, feature, and developer.

Short-lived scoped keys Feature-level spend attribution Gateway-enforced budgets
01Live product surface

Dashboard assembled from this page

See one AI request move from project to provider, with governance at every step.

AIMSControl plane
NorthwindPaymentscheckout-redesign
Live

Request source

ProjectNorthwindPayments
Requestcheckout-redesignActive request
SourceAPI / SDK

AIMS Gateway

Operational · Governed routing

  • Entitlement checksActive
  • Model selectionActive
  • Request routingActive
  • Budget controlsActive
REQ_8F21routing
Telemetryattributed per request

Models

GPT-5Model · Entitled
ClaudeModel · Entitled
GeminiModel · Entitled

Providers

OpenAIProvider · Routed
Azure OpenAIProvider · Routed
3,149Requests routed
68%Budget utilised
£42.36Current spend
02Core capabilities

What the platform gives you

AIMS is the control layer between developers, models, projects, and spend. It keeps access secure, usage attributed, and spend under control.

AIMS Control layer for governed AI usage

Governed key brokering

Short-lived virtual keys replace long-lived provider keys.

Virtual keyTTL 4h
sk-live-••••••7f2a
Scoped · 1 projectRevocable instantly

Full spend attribution

Every token traced from organisation to developer.

  1. Org
  2. Project
  3. Feature
  4. Dev
  5. Spend
Northwind › Payments › checkout-redesign £4,210
100% attributed

Per-project entitlements

Admins choose exactly which models each project may use.

ModelOpenAIAnthropicGoogle
Payments Allowed Allowed Blocked
Onboarding Blocked Allowed Allowed

Projects, features & quotas

Projects carry model allow-lists and monthly budgets.

Payments84% of budget
£4,210 / £5,00080% alert sent
checkout-redesignrefund-flow
03How it works

From sign-in to attributed spend, in four steps

Every AI request is authenticated, scoped, routed, and costed on its way to the model. Nothing depends on a developer remembering to do it.

  1. OIDC

    Step 1: Sign in with your work identity

    Developers sign in with their existing OIDC identity. No new passwords or personal accounts.

  2. TTL 4h

    Step 2: AIMS mints a short-lived, scoped key

    A scoped virtual key is issued per session for allowed models only. Minting a new key revokes the old one immediately.

  3. Single gateway

    Step 3: Requests run through one governed gateway

    Every call goes through one OpenAI-compatible gateway. Provider keys stay behind the gateway and unpermitted models are blocked at source.

  4. Auto-rollup

    Step 4: Spend is tagged and rolled up

    Each request is tagged to organisation, project, feature, and developer. Usage and cost roll up automatically by team and feature.

    Illustrative

A management plane in front, an inference gateway behind. Access and attribution are enforced, not asked for.

04Architecture

One request.
Fully traced

Follow a request from developer to model to final spend.

  • Management planeDecides who can call what, and records the spend.
  • Inference gatewayHolds the provider keys and routes the call.
Request trace Live

Management plane

  1. Request REQ_7F2Aa.carter · VS Code
  2. Govern AllowedWithin budget
  3. Context Paymentscheckout-redesign

Inference gateway

  1. Gateway Scoped keyTTL 4h · 1 project
  2. Provider GPT-5OpenAI · 842 tokens

Management plane

  1. Attribution £0.18100% attributed
05The core loop

Provider entitlement spend, on repeat

Every request is checked before it runs, routed through AIMS, tagged to the work, and attributed as readable spend.

Request routed Policy checked Usage attributed Next request

Provider

  • GPT-4.1
  • Claude
  • Gemini

Entitlement

  • PaymentsAllowed
  • OnboardingBlocked
AIMS Govern every request

Spend

£4,210.00 100% attributed

Next request

checkout-redesign
  • Control every requestPolicies enforced at the gateway
  • Route securelyProvider keys stay behind AIMS
  • See real spend100% attributed to the right work
A management plane in front, an inference gateway behind.

Access and attribution are enforced, not asked for.

06·Request Authorisation Flow

How one request gets allowed or denied

AIMS evaluates identity, entitlement, and policy before the request reaches a provider.

  • Enforce policyIdentity, entitlement, and project checks
  • Stop unwanted spendBlock requests before they run
  • Route securelyAllowed requests reach the provider

1Request
POST /v1/chat/completions REQ_7F3A northwind/payments
Project
Payments
Feature
checkout-redesign
Developer
dev@company.com
2Authorisation
  • Identity Verified
  • Entitlement Model allowedModel not allowed
  • Project PaymentsNot evaluated
  • Policy Within policyNot evaluated
CheckingEvaluating request AllowedBlocked Request meets all policiesGPT-4.1 isn’t on the Payments allow-list
3Result
GPT-4.1Request routed to providerNot sent to provider
Response
1.4s–
Tokens
8420
Cost
£0.004£0.000
100% attributedNo provider spendTracked to northwind/paymentsNothing sent, nothing billed
The decision happens before provider spend.
07·Attribution

Every token, resolved to a line you can read

Spend arrives already broken down the way you work. The person signing for the bill can finally answer what it bought.

  • Charge back by teamEvery pound lands on the project that spent it.
  • Find runaway featuresSee which feature jumped before the invoice does.
  • Know who spent itSpend per developer, without spreadsheets.
  • Audit any requestTrace one call to its key, model, and owner.

Every request carries org=Northwindproject=Paymentsfeature=checkout-redesigndev=a.carter

AIMS This month 100% attributed
  1. NorthwindOrganisation
  2. PaymentsProject
  3. checkout-redesignFeature
  4. a.carterDeveloper
AI spend checkout-redesign
£4,210 128.5M tokens39% of spend
Attributed spend Highest spend first · Select a line to trace it
  • Payments › checkout-redesignNorthwind · 128.5M tokens £4,210 39%
  • Payments › refund-flowNorthwind · 82.1M tokens £2,680 25%
  • Onboarding › kyc-checksMeridian · 56.4M tokens £1,940 18%
  • Support › ai-assistantNorthwind · 36.3M tokens £1,190 11%
  • Risk › fraud-scoringMeridian · 23.2M tokens £760 7%
Unattributed £0 · 0%
Every request is attributed at the gateway, before it reaches a provider.
08Why AIMS, not the alternatives

Provider dashboards show spend. AIMS adds governance context.

A provider can tell you what was consumed. AIMS connects it to the work, policy, and ownership.

Provider dashboard

Model provider view
Total spend £4,210 19.7M tokens · GPT-5 · after the fact
Project
Not visible
Feature
Not visible
Policy
Not visible
Owner
Not visible
Budget
Not enforced
Project, feature, policy, owner, budget
Not visible

What was spent

AIMS governance view

Same traffic, full context
Total spend 100% attributed £4,210 19.7M tokens · GPT-5 · at the gateway
Project
Payments
Feature
checkout-redesign
Policy
Allowed
Owner
alex@northwind
Budget
£4,210 of £5,000

What it bought

  • See beyond spendProject and policy context
  • Bring accountabilityConnect usage to the right work
  • Make spend actionableTurn usage into useful insight

Same request. Different answer.

From “who spent it?” to “what was it spent on?”

09Objections, answered

Common questions

No. AIMS sits in front of your existing OpenAI-compatible gateway. It governs access and attribution without replacing the inference layer you already have.base_url = "https://<your-aims-gateway>/v1"
Requests are rejected at the gateway with a clear 403 response. Alerts fire at 80% and 100% via the dashboard. Two-stage approval is required to raise a project's budget.HTTP 403 · budget_exceeded
No raw provider keys are distributed. Developers authenticate via OIDC and receive a short-lived virtual key scoped to their project. The gateway is the only component that ever holds provider credentials.aims key mint --ttl 4h --scope checkout-redesign
Setup is a base URL change plus a virtual key header. The AIMS gateway is OpenAI-compatible, so no SDK is required.base_url = "https://<your-aims-gateway>/v1"

Get started

Governed access. Honest attribution.

Request early access See pricing