---
title: "Questions: What Token Observe is"
canonical_url: "https://tokenobserve.com/faq/what-it-is"
published: 2026-09-02
last_updated: 2026-10-15
---

# Questions: What Token Observe is

What the product does, who it suits, its current stage, that it has no reference customers yet, and the limits of a pilot.

Q: What is Token Observe?
A: Token Observe is a cloud platform for the IT team that owns the AI bill, with customer hosting also available. The small hosted pilot connects OpenAI, Anthropic Claude, xAI Grok and Google Cloud Billing reporting sources using their required administrative or reporting credentials. It keeps costs by currency, period and source status, separate from gateway token-price estimates. Supported requests routed through a workspace can be governed with agent identities, permissions, budgets, policies and an audit record. Billing access does not recover historical prompts or browser conversations. Capture defaults to metadata, with bounded redacted text opt-in; hidden chain of thought is not readable evidence. The cloud service holds workspace evidence and supplied credentials, unlike a customer-hosted installation.
Cite: https://tokenobserve.com/faq/what-it-is#what-is-token-observe

Q: What is Token Observe not?
A: Token Observe is not a FinOps suite for your whole cloud bill: it covers AI services, subscriptions and model traffic, and nothing else. It does not discover every subscription by itself (an invoice import finds what the invoice lists), and it does not read hidden chain of thought, because no provider exposes it. It is not an LLM evaluation platform, not an identity provider, not a sandbox or durable agent runtime, not a CMDB-style AI inventory, not a general AI firewall or prompt scanner, not a static agent-BOM scanner, and not an agent marketplace. Those are named strategic non-goals in Token Observe’s own roadmap, and the instruction that follows them is to build adapters and evidence exchange for those layers instead, so the recorded strategy is to federate your identity system, consume your security platform’s verdicts, and run above or beside your existing gateway rather than ask you to remove any of them. It does ship a registry, provider routing, quotas, cost dashboards, prompt and response redaction, trace trees and MCP tool ACLs. These capabilities support the spend, activity and access controls described across the platform pages.
Cite: https://tokenobserve.com/faq/what-it-is#what-is-token-observe-not

Q: How does Token Observe work out what our AI costs?
A: The cloud pilot connects supported provider reporting sources: OpenAI organization costs, Anthropic organization cost reports, xAI team API usage and a configured Google Cloud Billing BigQuery export. Each needs the required reporting permissions and credentials; these sources do not cover every subscription plan. Reports preserve currencies, periods, collection freshness and partial or failure status. Provider-reported costs, imported invoices and gateway token-price estimates stay separate, so overlapping measurements are not added together. Missing evidence is unknown spend, not zero. The workspace also has an existing invoice-import path; the new cloud portal does not yet provide its own CSV upload or automatic synchronization of those imports. Provider billing does not prove team attribution or captured activity for directly executed provider calls.
Cite: https://tokenobserve.com/faq/what-it-is#how-does-token-observe-work-out-what-our-ai-costs

Q: Is Token Observe the same product as AgentControl Plane?
A: Yes. AgentControl Plane is the engineering name Token Observe was developed under. The private repository and technical identifiers still carry that name or ACP; Token Observe is the product name on this site. The product now has a separate hosted cloud pilot as well as customer-hosted deployment support. The cloud data-custody and trial behavior differ from customer hosting. The repository documentation, threat model, cloud handoff and known-issues list remain the source of truth for a review.
Cite: https://tokenobserve.com/faq/what-it-is#is-token-observe-the-same-product-as-agentcontrol-plane

Q: What does agent action assurance mean, and is it still what Token Observe leads with?
A: Agent action assurance means proving that a specific delegated authority, and the business effect that followed from using it, both stayed legitimate. The trigger is a consequential, externally observable action (a refund, a deployment, an email, a ticket transition, a database write) where the API returning 200 is not acceptable evidence that the thing happened, or happened only once. Effect contracts, payload-bound approvals and an anchorable audit chain are what answer it, and all three still ship; the platform pages describe each one. It is no longer what the product leads with. The product direction was updated on 6 September 2026 to a platform for seeing AI spend and observable AI activity, identifying unauthorised tools and governing access, aimed at SMBs and mid-market businesses, and the roadmap that records that change says in terms that it supersedes the earlier action-assurance-led direction and that these capabilities are retained rather than the default source of new scope. If action assurance is the reason you are here, nothing has been removed and the capability pages are the place to start. If you arrived about an AI bill nobody can explain, that is now the front door.
Cite: https://tokenobserve.com/faq/what-it-is#what-does-agent-action-assurance-mean-and-is-it-still-what-token

Q: Who is Token Observe for?
A: Token Observe is for the head of IT or IT director at a mid-market business who owns the AI bill and tool estate. Start with a supported provider billing source, then add activity from agents you explicitly route through the workspace. The hosted service is a small pilot with shared admission and traffic limits, not a production-critical or high-availability service. The self-service portal currently creates an owner/admin workspace and does not expose colleague invitation or organization membership management. Customer-hosted design-partner scope is arranged separately.
Cite: https://tokenobserve.com/faq/what-it-is#who-is-token-observe-for

Q: What does Token Observe include?
A: Three areas: spend, activity and access. The cloud pilot reports costs from supported billing sources, preserving currency, period, source freshness and partial/failure status; gateway token estimates remain separate. Activity comes from requests routed through the workspace or supported evidence sources you configure, not historical conversations reconstructed from billing. Conversation capture defaults to metadata, with bounded redacted text opt-in and workspace activity retention configured to 30 days. Agent identities, permissions, budgets and policies govern supported gateway traffic. Some deployment capabilities described on this site require customer-hosted configuration: arbitrary MCP and webhook destinations are disabled in the initial cloud environment, and endpoint-seat governance remains preview.
Cite: https://tokenobserve.com/faq/what-it-is#what-does-token-observe-include

Q: What stage is Token Observe at, and can it run production-critical workloads?
A: Token Observe has a deployed small cloud pilot and separately scoped customer-hosted design-partner arrangements. The cloud trial starts at workspace creation and lasts 30 days. Keep workloads whose outage would harm customers or regulated operations outside this release. Governance fails closed; the cloud pilot has one replica and shared process, storage and traffic limits, without an availability SLA or independent penetration test. Source and public signed-out checks passed, but a completed real customer signup, authenticated workspace and live provider journey remains unqualified in the product record. Broad general availability remains a no-go. Counsel-approved terms, independent security testing, accepted residual risks, immutable release evidence, environment readiness, written pilot scope, partner-shaped capacity and recovery, live integrations, success criteria and named operations owners remain the gates for broader use.
Cite: https://tokenobserve.com/faq/what-it-is#what-stage-is-token-observe-at-and-can-it-run-production-critica

Q: What does early access mean for us in practice?
A: It means a small cloud pilot, not a general-availability service. Follow /start to the cloud portal, create an account, confirm your email and create a workspace. The hosted trial lasts 30 days from workspace creation, with no card or automatic paid conversion. Provider calls, model-assisted search and Google BigQuery scans can still incur charges. After expiry, workspace changes, model traffic and scheduled collection stop; authorized retained reads and exports remain within the shared traffic quota. Customer-hosted evaluations have separate installation and licence terms. The cloud pilot holds workspace data and supplied credentials and has no availability SLA or independent security assessment.
Cite: https://tokenobserve.com/faq/what-it-is#what-does-early-access-mean-for-us-in-practice

Q: Who else is running this?
A: Token Observe has no reference customers yet.
Cite: https://tokenobserve.com/faq/what-it-is#who-else-is-running-this

Q: Is Token Observe wrong for us?
A: Sometimes, and these are the answers that are no. If your AI spend is one subscription on one card, a register and an import template are more machinery than that needs; this is built for a bill that is already several subscriptions plus at least one metered API account, in more than one currency. If you need a single blended AI number for a board slide, you will not get one: a billed charge and a metered token estimate are never added together and no currency is converted, so what this produces is a table you can defend line by line rather than a total. If you want the tool nobody told you about to be discovered for you, an import finds what the invoice lists: a subscription on an invoice nobody has exported stays unknown, and nothing here discovers your estate on its own. If the tools you are worried about are seat-priced, like a per-user coding assistant or a business chat plan, a per-request USD ceiling is explicitly inert against them, because a subscription prices the seat rather than the call, and the endpoint-seat hook that would govern the device is a preview rather than production-eligible. If you need a transcript of what an employee typed into a browser assistant, a network feed gives you a destination and a hostname, not a conversation and not a verified employee identity. If you cannot accept inline governance that fails closed, stop here: when Token Observe is unavailable the agents it governs stop calling models, it runs as one active process on one node with no replica and no clustering, and there is no availability service level and no service credits, so anything whose outage would harm customers or regulated operations belongs outside this release. If what you want is one switch that stops the spending, the kill switch stops every agent authenticated to Token Observe and cancels nothing at the vendor: it records the decision and names the owner, and only the vendor can end the seat. And if your procurement process requires a SOC 2 report, an ISO 27001 or ISO/IEC 42001 certificate, or an independent penetration-test result before a first install, none of those exists, none is in progress, and certification is deliberately not on the near-term roadmap.
Cite: https://tokenobserve.com/faq/what-it-is#is-token-observe-wrong-for-us

Q: What are the limits we would have to accept?
A: Ten, in the order a head of IT tends to hit them. Availability: governance is inline and fails closed, so if Token Observe is unavailable the agents it governs stop calling models. One active process on one node, no high availability, no availability service level and no service credits. Assurance: no SOC 2, no ISO 27001 and no ISO/IEC 42001 (none held, none in progress, and certification deliberately not on the near-term roadmap), and no independent penetration test either. Discovery: an invoice import finds what the invoice lists, so a subscription on no invoice you give it stays unknown, and nothing here discovers your estate on its own. Arithmetic: a billed charge and a metered estimate are never added together and no currency is converted, so there is no single blended AI total for a board slide. Classification: three authorization states rather than four, and an approval is the current decision for an exact vendor, tool, team and owner match rather than proof that a tool was authorised at the moment somebody used it. Identity: a network feed gives you a destination, not a transcript, and a hostname is not a verified employee identity. Seats: a per-request USD ceiling is explicitly inert against a subscription seat, because a subscription prices the seat rather than the call, and seat governance is preview rather than production-eligible. Reach: the kill switch stops every agent authenticated to Token Observe and cancels nothing at the vendor; it records the decision and names the owner, and only the vendor can end the seat. Evidence: the audit chain is tamper-evident rather than tamper-proof and exports are digest-sealed rather than signed. Detection: policy, redaction and injection scoring are heuristic, so free-text personal data and non-UK or non-US identifier formats are not detected at all. Then the formal version, which is what a pilot signs. The release gate names four residual risks a pilot has to accept in writing at minimum: single-node SQLite, no vendor-operated SLA, no independent certification, and the preview limitations on endpoint seats. The threat model goes further and assigns each remaining risk to the role that must record a dated acceptance: the CISO for heuristic injection detection, for the audit chain being tamper-evident rather than tamper-proof, for the unauthenticated on-behalf-of header, for identity-provider group claims being a snapshot rather than a live directory read, for the absence of MFA on local accounts, and for long-lived agent bearer tokens; the data protection officer for the limits of regex personal-data detection; the head of product for provider data-policy flags being unverified operator assertions; and the engineering lead for single-writer SQLite. An empty field is a failed gate, and anything not on that list and not mitigated is treated as an unrecorded gap, which is itself a finding.
Cite: https://tokenobserve.com/faq/what-it-is#what-are-the-limits-we-would-have-to-accept