Cloud custody, evidence and security limits.

What does the vendor receive from a running deployment?

Cloud workspaces store account records, billing evidence, configured activity and encrypted connection credentials on Token Observe infrastructure. Optional customer-hosted runtime operation has no vendor telemetry or licence callback.

Where does our data go?

Cloud processing uses Token Observe’s Railway-hosted runtime, Supabase Auth and the supported provider sources you connect. Optional customer hosting has a separate configurable egress inventory below.

Do you store our prompts and the model's replies?

Not by default. Conversation capture ships in metadata mode and keeps no prompt or reply text; switching it to redacted stores both, mask-redacted before truncation and bounded. Tool arguments and results are stored either way, capped at 16,000 characters.

Can we trust the spend numbers?

As far as they claim to go. Billed and metered are never added, an import finds what the invoice lists, and the estate report states its own completeness as false.

Is the audit trail tamper-proof?

No. It is tamper-evident, and the customer-hosted default is unkeyed. A test forges a chain on a default install deliberately, so the limit is a tested fact.

Are you certified, and has it been penetration-tested?

No SOC 2, no ISO 27001, no ISO/IEC 42001, and no independent penetration test. The internal work that has been done is published rather than summarised.

Who has to sign for the risks that remain?

Nine risks, each with the role the product's own threat model names. At a business without a CISO or a DPO, all nine land on the head of IT.

What is our half of this?

For cloud, choose connected accounts, credentials, capture mode and routed clients. The host/TLS/backup controls below apply to optional customer-hosted installation.

What does each individual capability not do?

Every capability's own limits are published here rather than on its product page, grouped under the three pillars, each at its own anchor. The list above is the product-wide summary; that section is the per-feature detail an assessment works from.

Is Token Observe wrong for us?

Possibly. The short version: no availability service level, no certificate, one node, no discovery of subscriptions nobody exported, no single blended AI total, and a kill switch that stops agents rather than the vendor's billing.

The evaluation licence

For optional customer-hosted evaluation, thirty days from first installation, for internal evaluation, security review and proof of concept, with no order form, no signature and no fee. Section 3.3 says in terms that the clause exists so a prospective customer’s security team can read, run and attack the software before a purchase order is raised. It must not be used to process live production traffic or regulated personal data, and it carries no support commitment, no warranty and no service level of any kind.

What you may publish

Benchmark results, naming the version and configuration, with no pre-approval. Security assessment findings, naming the software, after coordinated disclosure. Note the drafting: section 9.1 widens the right to test to any person operating an evaluation, while the publication rights at 9.2 and 9.3 are drafted as the Licensee’s, so an evaluator publishing before an order form exists should agree that in writing first.

Where to start a review

The published known-issues list and the STRIDE threat model. The first names the file, states the concrete cost and describes the attack that works; the second names the residual risk on every trust boundary and the role that has to accept it.

The status of the licence itself

Section 6.1 undertakes the no-telemetry position in terms rather than merely describing it — but the published licence carries its own banner: it was drafted by the engineering team rather than by qualified counsel, placeholders remain in it, and it asks to be treated as a statement of intended commercial terms rather than as an executed grant of rights until that review is complete. The clauses quoted on this page are quoted as that stated position and not as an executed one, and the agreement you sign is what ultimately binds. The product documentation is likewise expressly not a warranty or a contractual specification unless an order form makes it one.

Licence-compliance verification

Self-certification only, and by construction: because the software reports nothing to the licensor, there is no visibility of your usage. One written certification per twelve months on thirty days’ notice is permitted; there is no right to inspect your systems, to require a metering component, or to receive your records.

Model providers

The governed request after unicode sanitisation and after the redaction plan has been applied, plus your API key read from the process environment. OpenAI, Anthropic, Google, OpenRouter, Bedrock, Azure, or any OpenAI-compatible endpoint you register, including a self-hosted one.

MCP tool servers

The tool name and its arguments, after policy evaluation and after inbound redaction, with the per-server auth header read from the environment. On every allowed tools/call, and on catalogue refresh.

Webhook receivers

A JSON event carrying identifiers, counts, policy names and a one-line human summary, signed with x-acp-signature when a secret is configured; Slack receivers get the summary text only. Sent best-effort on a later tick, because a webhook can never delay or fail the governed request that produced it. Treat receivers as inside your data boundary all the same: an approval.requested event carries the action summary, which is the agent, tool or model name plus the policy’s own reason — your reason text, which can perfectly well name a customer, an amount or a destination. It carries no model-proposed arguments.

The model-price catalogue

A GET for the public OpenRouter price list, sending no prompt, no trace and no identifier — with one caveat: it does send your OpenRouter key if one is configured, for rate-limit purposes. It runs only when an admin calls POST /api/prices/sync. The call also carries HTTP-Referer and X-Title attribution headers, which identify the gateway software and name the project’s public repository; they do not identify the agent, the user or your organisation, and they reach OpenRouter rather than the vendor.

Your identity provider

The standard Authorization Code with PKCE exchange — the issuer’s discovery document and JWKS, then a POST to its token endpoint. No prompt, no trace, no agent, no payload; this flow is about one human signing in, and an install that never configures OIDC makes no such call.

Your anchor sink

One signed statement per anchoring interval about the shape of the audit chain: head sequence and hash, entries covered, the previous anchor’s hash, the key id and the signature. No payload, no identifier and no personal data. A file sink writes the same statement to local disk and makes no network call at all.

Vendor pull connectors, off by default

Two exist and no more. GitHub Copilot seat spend is read from api.github.com, using a GitHub App private key that buys nothing but a nine-minute JWT and a one-hour installation token; a usage report can come back as a signed link on a *.githubusercontent.com host, which is fetched without the credential attached. Cisco Umbrella DNS and proxy activity is read from api.umbrella.com under an API key scoped to reporting read. What goes out is the credential, your organisation login and a date window — no prompt, no trace, no payload and nothing out of your own evidence store — and what comes back is that vendor's own reporting data. The destination is the vendor's API, not Tenhaw's. Both connectors are gated twice over: ACP_CONNECTORS_ENABLED defaults to false, and a connector counts as configured only when the environment variables its definition declares are present, so withholding the credential is a supported position.

# The single highest-value hardening step for a deployment whose model
# endpoints are not the public vendor ones. No list may be empty: a
# variable that is set but lists nothing is refused at boot, because an
# empty allowlist would otherwise read as "any host" and "any variable".

ACP_ALLOWED_PROVIDER_HOSTS=llm.internal.example.com
ACP_ALLOWED_KEY_ENV_PREFIXES=ACP_PROVIDER_

ACP_ALLOWED_MCP_HOSTS=tools.internal.example.com   # default: loopback only
ACP_ALLOWED_MCP_KEY_ENV_PREFIXES=ACP_MCP_

ACP_ALLOWED_WEBHOOK_HOSTS=siem.internal.example.com  # no safe default exists
ACP_ALLOWED_WEBHOOK_KEY_ENV_PREFIXES=ACP_WEBHOOK_

# The fourth pair matters only if you enable a vendor pull connector.
# It defaults to the two vendor APIs the shipped connectors need, and
# ACP_CONNECTORS_ENABLED defaults to false, so leaving all three lines
# alone leaves both connectors off and neither host contacted.
ACP_ALLOWED_VENDOR_ADMIN_HOSTS=api.github.com,*.githubusercontent.com,api.umbrella.com
ACP_ALLOWED_VENDOR_ADMIN_KEY_ENV_PREFIXES=ACP_VENDOR_ADMIN_
ACP_CONNECTORS_ENABLED=false

# The credential buckets are disjoint by design: a name that a provider
# row may reference is not one an MCP, webhook or connector row may use.

seats

The only table whose primary subject is a human other than an operator: a named employee and the subscription tool they hold a seat on. It supports a coverage census, so it is a list of who is and is not governed. Trace retention does not cover it and subject erasure does not reach it.

user_idp_groups

The directory groups your identity provider asserted about one named person at their last sign-in. That is an attribute of a person, held about a person, and a data protection officer should treat it as HR-adjacent data rather than as configuration. Capped at 500 keys per person, replaced wholesale at each sign-in, and aged out on its own window.

radar_findings

Detector output from the evidence the radar holds — what you exported into it, plus whatever a pull connector you enabled has read back from GitHub Copilot or Cisco Umbrella. It may include workstation hostnames, staff usernames, service-account and key identifiers, billing amounts, and — where per-user seat spend is present — the email addresses of named employees. Retained indefinitely; neither the retention window nor subject erasure reaches it.

approvals

The decision record: who approved, when, their written rationale, the payload hash, and the action summary — the tool or model name plus the policy’s own reason, capped at 240 characters, and mask-redacted on the proposed-tool-call path. Not purged by the retention window and not reachable by subject erasure, so it is the one place policy-reason text outlives the trace it came from.

webhook_deliveries

The exact bytes POSTed to each receiver, kept so a signature dispute can be settled, and not purged.

audit_anchors

No payload, no identifier and no personal data — a statement about the shape of the chain rather than about anything in it. This is the one table meant to be handed to an outside auditor.

Estate report: API activity

“Only gateway model requests are priced here; imported telemetry can omit costs, so a zero recorded estimate does not prove free or fully accounted use.” Quoted from the report’s own completeness block, which is hard-coded to complete: false.

Estate report: billing coverage

The invoice ledger covers supplied imports. The cloud provider-account report separately covers connected organization billing sources and exposes collection freshness and coverage. Live customer account collection remains unqualified.

Estate report: what registration means

“Subscription registration expresses approval, not proof of traffic capture or endpoint enforcement.”

Estate report: subscription traffic

“A missing trace is unknown coverage, not proof of inactivity; browser visits and total vendor usage are not included.” Charge detail and the register are capped at 1,000 rows each, and any truncation is declared rather than left to be noticed.

Reading it from an agent

The MCP spend report returns the same figures under the same team scope as the dashboard, and the calling subject needs an explicit report grant and a report-team grant. Being assigned to a team does not by itself confer reporting access, which is what stops an Engineering-scoped agent reading Finance’s invoices.

An empty result, and the product refuses to read it as an all-clear: nothing found is not the same as nothing being there, and a zero here is not a clean estate. Coverage stays on its own axis, so silence is never mistaken for an approval.

Sample data in the real Token Observe interface, recorded from a local evaluation with a temporary database, a mock provider and one request. No live provider key was used.

Injection scanning on both channels

Unicode is sanitised to a fixpoint before anything reads the payload, then prompts and tool results are scored, with tool-result findings weighted 1.25× because that is where indirect injection arrives. The residual: these are regex heuristics, and paraphrase, translation or non-English phrasing defeats them. Sanitisation is a separate control with a separate limit — the unicode tag block, zero-width characters, bidirectional overrides and private-use ranges are stripped before storage and display, so ASCII smuggling cannot hide instructions from a human approver, but homoglyph substitution is not addressed at all.

MCP tool integrity pinning

A descriptor hash over the canonicalised name, description and input schema, re-verified at the 60-second catalogue TTL and on live-listener maintenance; drift quarantines the tool and emits an event. The residual is the window: a change may be served from the trusted snapshot until the next refresh, at most 60 seconds on access.

The console is a trust boundary of its own

Every response carries nosniff, X-Frame-Options DENY and Referrer-Policy no-referrer, and console responses add a same-origin content security policy. A test asserts that no http://, https:// or * can ever appear in it, because a well-meant font CDN is how a narrow policy stops being one. The directive that matters most is frame-ancestors none: without it, a page on any origin can frame this console and land a click on Engage kill switch.

Budgets and rate limits

Per-request, hourly, daily and monthly ceilings checked pre-flight, with USD admission atomically reading projected spend and reserving per agent. The residual is arithmetic rather than architectural: a provider-reported final cost can exceed the pre-flight estimate, and the token and request windows are not distributed admission counters.

Trace search never generates SQL

The model emits a schema-validated filter object, never SQL; queries are parameterised; and the signed-in user’s team predicate is applied after translation, so it cannot be supplied or removed by the model.

403  ACP_KILL_SWITCH_ENGAGED   evaluated first; beats every other gate
403  ACP_AGENT_NOT_ACTIVE      lifecycle state; step 6, right after the switch
403  ACP_RBAC_DENIED           deny-by-default; explicit deny wins
403  ACP_POLICY_BLOCKED        a policy matched and its action was block
403  ACP_DELEGATION_DENIED     the chain could only narrow, and it did
403  ACP_ZDR_UNAVAILABLE       no route satisfies this agent's data policy
429  ACP_BUDGET_EXCEEDED       pre-flight admission, not post-hoc billing
429  ACP_RATE_LIMITED          carries Retry-After
503  ACP_AUDIT_UNAVAILABLE     verification failed; writes latched

Two role universes, kept apart

A user’s control-plane rank is only ever set by an admin. Roles mapped from identity-provider groups are a permission mask used on the agent path alone. No directory group can promote anyone in the console.

The on-behalf-of mask

Two of the three enforcement settings refuse nothing: off is the default and reads no principal at all, and shadow resolves and records what it would have refused while letting the request through. Only enforce is a control; the other two are instrumentation, and an install that has not reached enforce should not describe the intersection as a mitigation it holds.

Sessions

Server-side rows with a 24-hour expiry that survive a restart, so revocation is real: an admin can drop every session for a user, and a password change drops that user’s other sessions. Expired rows are removed by an hourly pass even if the cookie is never presented again.

/metrics

Unauthenticated by Prometheus convention, and it exposes agent identifiers and month-to-date spend, so it must be reachable only from your monitoring network. Only the matched route pattern is ever used as a label, so a caller cannot write arbitrary text into the scrape output and cardinality is bounded by construction.

Edit a row without re-hashing

Detected either way, and located to an exact sequence number.

Delete a middle row

Detected either way.

Delete the tail and stop logging

Ordinary SQL deletion is detected, because SQLite does not lower the sequence high-water mark on DELETE — but a malicious database writer can lower that local row too, so only a previously recorded off-box head or anchor proves a stopped tail against that actor.

Rewrite the entry and recompute the whole chain

Undetected on the unkeyed default. Detected keyed, because the digests are MACs and cannot be recomputed without the key.

Rewrite an entry written before the key existed

Undetected unkeyed. Detected keyed, because altering it moves the head the boot checkpoint sealed.

Read the key out of the host’s environment

Undetected either way, and explicitly out of scope. That is a host compromise, and no in-database scheme survives one.

# Once, at key generation. The private half is what the deployment holds
# and belongs in your KMS; the public half is all an auditor ever needs.
openssl genpkey -algorithm ed25519 -out anchor.pem
openssl pkey -in anchor.pem -pubout -out anchor.pub

# Months later. No install, no database, no network. The verifier imports
# only the zero-dependency core and Node built-ins, loads nothing native
# and touches no database.
node scripts/verify-anchor.mjs --anchors anchors.jsonl --public-key @anchor.pub

# After one rotation, retired keys newest to oldest:
node scripts/verify-anchor.mjs --anchors anchors.jsonl \
  --public-key @anchor-new.pub \
  --previous-public-key @anchor-old.pub

# exit 0 trusted, 1 not trusted, 2 usage error.  --json for a pipeline.
# --public-key is REQUIRED and must arrive out of band: a signature
# checked against a key read out of the artefact being verified proves
# nothing at all.  --allow-partial is required before a file that does
# not start at anchor 1 is accepted, because a chain beginning at 4 is
# a deletion rather than a shorter file.

Terminate TLS in front of it

And do not expose the control plane to the internet. HSTS is sent only when the request resolves as https, which behind a terminating proxy means telling Token Observe to trust that proxy — the same switch that decides whether the session cookie is marked Secure.

Set the session secret from a secret manager

The server refuses to start without it outside tests. Set the trust-proxy flag only when a trusted proxy is in front, because it is what makes a client-supplied forwarded header believable.

Set the four allowlist pairs to your own endpoints

The defaults are not one policy and should not be read as one: provider hosts default to the public vendor endpoints, MCP hosts to loopback only, webhook hosts to nothing at all — an unstated webhook policy resolves to the rows that already exist — and the vendor-admin pair to the two vendor APIs its connectors need. Each credential-prefix list defaults to purpose-specific names. Narrowing the first three to your own endpoints, and all four to your own variable names, is what stops an admin-level registry write from turning into a read of every secret in the process environment — the fourth pair cannot be narrowed to an endpoint of yours, because the only destinations it admits are the two vendor APIs, and the way to narrow that one is to leave the connector scheduler off.

Keep /metrics on the monitoring network

It is unauthenticated by Prometheus convention and exposes agent identifiers and month-to-date spend.

Set NODE_ENV=production

Which also makes the mock provider opt-in rather than opt-out.

Put single sign-on in front, then disable local login

This is the recommended posture, and it is the only one that closes the no-MFA residual risk: local control-plane accounts have no multi-factor authentication of their own, and setting ACP_LOCAL_LOGIN_ENABLED=false makes OIDC the only login path and refuses to boot unless the OIDC configuration is complete. It is also what the local technical-readiness check requires.

Treat the database file as evidence

Restrict access to it, back it up to immutable storage, and check that the audit verification endpoint returns valid: true after a restore. Backup scheduling, off-box placement, legal holds, freshness alerting and proven deletion are operator-owned controls, and live deletion does not reach data already in a backup.

ACP_TRACE_RETENTION_DAYS=180            # unset means keep forever
ACP_CALLER_SIGHTING_RETENTION_DAYS=90   # a separate window; 0 keeps it all

GET    /api/retention/status
       reports the window, the exact cutoff instant, how many traces are
       eligible now and the outcome of the last pass -- with the caller
       roll-up reported as a sibling block rather than folded in, because
       the two windows disagree by default and a reader who inherits one
       number for the other question has been misled by the shape of the
       answer.

POST   /api/retention/run               admin; runs one pass on demand

DELETE /api/retention/subject?subject=...&match=any&dryRun=true
       returns the count before anything is removed. Both the preview and
       the deletion are audited, under a digest of the subject rather than
       the subject itself.

• ×

  Token Observe has not had an independent penetration test.

  No third-party security assessment, red-team engagement or code audit has been carried out on it. The security work done so far is internal: a five-dimension adversarial review with a three-verifier refutation panel per finding, a STRIDE threat model, targeted testing of specific attacks including a forged audit chain and adversarial ReDoS inputs, and the automated release gates. That is real work, and it is still not an external test, so it is not presented as one. A pre-purchase penetration test by a prospective customer is welcome and expressly permitted by the licence.

• ×

  There is no SOC 2, ISO 27001 or ISO/IEC 42001 certification.

  None is held, none is in progress, and certification is deliberately not on the near-term roadmap. What exists instead is a control-by-control mapping to EU AI Act deployer articles, ISO/IEC 42001 Annex A, NIST AI RMF and the OWASP LLM and agentic lists, each framed as “this feature helps evidence that clause” rather than as compliance. A design-partner agreement can carry a contractual commitment, with a named date, to any certification milestone your procurement process requires.

• ×

  The audit chain is tamper-evident, not tamper-proof.

  Unkeyed is the default, and on a default install an operator with write access to the database file can rewrite an entry, recompute every downstream hash, and get valid: true. A test does this deliberately, so the limit is a tested fact. Keyed protection and off-box Ed25519 anchoring close most of it and both are off until you configure them; even then, key theft signs anything, history before the first anchor is covered by no anchor, a sink administered by the party that runs the database is not independent, and only an RFC 3161 authority or a public ledger proves when.

• ×

  Evidence exports are digest-sealed, not signed.

  A trace export and a compliance bundle carry a SHA-256 over the canonical JSON of the bundle and the embedded chain-verification verdict. That detects accidental or post-export edits; it does not prove origin. Durable origin evidence comes from authenticated delivery and, for the ledger head, from keyed audit plus an Ed25519 anchor retained independently of the database. WORM export, RFC 3161 timestamping and a Merkle tree for partial-log proofs are not built.

• ×

  There is no availability service level and there are no service credits.

  No uptime percentage, availability service level or service credits are offered for the cloud pilot. Live customer capacity, source-outage handling and actual backup/key recovery remain open qualifications. For customer hosting, availability also depends on the operator’s infrastructure. Existing software-support templates do not create a cloud service-level commitment.

• ×

  The cloud pilot uses one supervisor replica with bounded workspace child processes and separate SQLite databases. No high availability, point-in-time recovery or proven customer recovery objective is claimed.

  The recorded cloud deployment has one supervisor replica. Its parent registry and workspace databases, custody key and managed Auth have separate recovery requirements; backing up one child is not recovery of the service. Actual cloud snapshot/off-box/key recovery and timed customer recovery remain unqualified. Optional customer-hosted runtime counters and sessions must not be assumed safe to multiply across replicas. Planning recovery objectives are not commitments.

• ×

  There is no throughput or capacity commitment.

  The how-it-works benchmark is a thirty-second mock-provider laptop baseline for the server runtime, with its conditions and explicit limits. The newer cloud source also passed a bounded finite-resource synthetic read gate; it does not qualify real Auth/provider latency, inference throughput, customer workloads or Railway durability. Neither result is a customer capacity commitment.

• ×

  There is no claim that the vendor is legally never a processor.

  Cloud hosting makes Token Observe custodian of workspace data and encrypted connection credentials. The former claim that ordinary supply has no vendor processing path applies only to optional customer-hosted runtime operation without support disclosure. Legal roles, data processing agreements, subprocessor arrangements and transfer assessments remain for counsel review; no approved cloud agreement is asserted here. Redact diagnostics before sending and agree their handling.

• ×

  Token Observe does not make you compliant with any law, regulation or standard.

  It is a compensating control. It does not discharge any obligation you owe to a regulator, a data subject or a customer, and the vendor does not sign off your DPIA, FRIA, record of processing or risk register. Deciding risk tiers, running a fundamental-rights impact assessment and notifying regulators remain the deploying organisation’s duties; authoring your policy set and mapping it to your control framework is a professional-services engagement rather than support.

• ×

  The policy, redaction, injection-detection and routing controls are heuristic, and are not warranted to identify every instance of what they are designed to detect.

  Personal-data matching is regex plus checksum, so free-text personal data and non-UK/US identifier formats are not detected at all. Injection scoring is regex-based, and paraphrase, translation or encoding defeats it; homoglyph substitution is not addressed; markdown-image exfiltration is detected but outbound URLs are not rewritten. There is also no warranty that the published defect list is exhaustive.

• ×

  There is no MFA on local control-plane accounts, and SCIM is a bounded Users push rather than a live directory.

  For optional customer hosting, single sign-on moves MFA to your identity provider, and local login can be disabled entirely once it is rolled out — an install that configures neither retains local-password and manual-leaver risk. SCIM has no Groups, no live directory read and no hard delete, and group claims are a snapshot taken at sign-in rather than a live read, so a revoked group keeps granting authority until the person next signs in or the capture ages out.

• ×

  Endpoint-seat governance is a preview and is not equivalent to an inline gateway.

  The seat hook is marked preview and not production-eligible: it is an unsigned Node command rather than a signed native binary, its replay protection is bounded by a device clock the governed party controls, and its local evidence spool is unsigned. On an unenrolled device the files it relies on are ordinary files the user owns — device management is a prerequisite rather than a mitigation. A per-request USD ceiling is also explicitly inert against a subscription seat, because a subscription prices the seat rather than the call, so the marginal cost of one request is not knowable at the moment of deciding. Pre-1.0, only the latest published minor receives security patches; there is no long-term support branch and no backporting, because with one engineering team an LTS promise that cannot be kept is worse than none.

• ×

  An invoice import finds what the invoice lists; billing connections do not discover every subscription.

  The mapped invoice-import path reads supplied CSV/JSON, not a live vendor account. Cloud organization-billing connections separately use explicit reporting/admin credentials with provider-specific scope and unknown/incomplete coverage. Optional customer-hosted pull connectors and other supplied evidence have their own boundaries. A subscription absent from all connected or supplied sources stays unknown; no complete discovery or live-customer qualification is claimed.

• ×

  A billed charge and a metered estimate are never added together, and no currency is converted.

  They are different measurements. An invoice line is money that has already moved; a metered estimate is a calculation over observed traffic against a price table, and a blended figure reconciles against neither the vendor invoice nor the gateway. So subscription and API amounts are reported per currency with their evidence counts, metered estimates are recorded separately, and no exchange rate is applied anywhere — a euro charge is reported in euros. If what you need is one number for a board slide, this product will not give you one, and that is a decision rather than a missing feature.

• ×

  A source nobody has connected is reported as unknown, never as zero.

  Zero usage and no visibility look identical on a chart and mean opposite things, so they are never rendered as the same value. Coverage is measured on its own five-state axis across six evidence streams, every radar pass records a run row whatever the outcome so that a dead feed is distinguishable from a clean estate, and the estate report hard-codes its completeness to false and prints the reasons. Imported telemetry can also carry no cost at all, so a zero recorded estimate does not prove free or fully accounted use. Nothing on this site should be read as “every AI tool in your business”.

• ×

  There are three authorization states, not four, and approval is a current decision rather than a historical one.

  The register stores approved, prohibited or unknown, enforced by a CHECK constraint in the schema, with unknown as the default on creation so nothing passes by silence. Coverage (whether anything has been observed at all) is a separate axis and is reported separately. Approval is the current decision for an exact vendor, tool, team and owner match, so the register does not prove that a tool was authorised at the moment somebody used it, and a match that is missing the tool or the team stays unknown rather than inheriting an approval from elsewhere.

• ×

  An approved, paid subscription is never reported as unauthorised use — and that suppression is one detector, not the whole radar.

  A tool that alarms about the subscriptions you already approved gets muted inside a fortnight, so an exactly attributed approved entry suppresses the finding. The scope is narrower than the sentence suggests: the register is consulted in exactly one place, inside the per-user seat-spend detector. Billing reconciliation, network egress, service-account key audit and IDE telemetry findings never read it, and the browser-AI path fixes authorization at unknown regardless of what the register says.

• ×

  A hostname is not a verified employee identity, and a network feed is not a transcript.

  An egress export you supply gives a source host and a destination host. Network contact does not establish who used AI, whether a subscription was paid for, what was typed, what came back, how many tokens it cost or whether anybody authorised it — the radar writes that limitation onto the finding rather than leaving it to be inferred, and browser AI destinations are classified as metadata observations only. Nobody should buy this expecting to read what staff typed into a chat window. The personal data that does accumulate is named here: the seat census holds employees by name, and radar findings can carry workstation hostnames, staff usernames and named employee email addresses. Neither the retention window nor subject erasure reaches either table.

• ×

  Hidden chain of thought is not available from any provider, so it is not recorded and not claimed.

  A record of what an agent was asked and what it then did is not a record of why it decided. Where a provider returns a reasoning summary, that summary is captured and labelled as one; the model's hidden reasoning is not exposed by any provider Token Observe routes to, and no configuration produces it. Conversation capture is also off by default: the default mode stores no message text at all, and prompts and replies are kept only when it is switched to redacted.

• ×

  The kill switch stops agents authenticated to Token Observe. It cancels nothing at the vendor.

  It is evaluated first and beats every other gate, scoped global, team or agent, and it reaches every governed subject enrolled with the product — agents and seats. That is the whole of it. It does not cancel a vendor subscription, reclaim a seat, change a payment plan, stop the charge at the vendor or end somebody's browser AI session. What it does instead is record the decision and name the owner, which is the part a vendor console will not do for you.

• ×

  Traffic that never comes through the gateway is not governed by it.

  Every inline control (policy, redaction, budgets, approvals, the audit record) acts on requests that route through Token Observe. An agent nobody pointed at it is invisible to all of them, which is why the shadow-AI radar exists as a separate control with its own operator-supplied evidence rather than as a claim that the gateway sees everything. Four of the radar's five sources are operator-fed, so it sees what you give it — plus, on the two streams a shipped pull connector covers, whatever that connector reads back once you have enabled it and supplied the credential, and no more.

• ×

  An approval queue nobody reads is a rubber stamp, and no product fixes that.

  Approvals are bound to a payload hash, single-use and expiring, and every decision records the approver, the time and their written rationale — but an approver who skims the action summary has approved what they were shown. The mechanisms that keep the queue readable are process controls: gates are scoped by risk rather than universal, every policy can run in shadow mode first so the false-positive rate is known before real work is held, and an install can refuse the move into enforcement until a backtest of that exact rule has been acknowledged by a named person. None of that is a guarantee that the queue gets read.

• ×

  There is no independently witnessed bake-off and no reference production deployment.

  No independent comparative test or reference production customer can be cited. The cloud pilot’s source tests, public guards and signed-out checks do not establish successful customer signup, provider collection or production outcomes. A customer-hosted evaluation remains an optional separate path with licence-scoped testing rights on infrastructure you control.

• ×

  Governance is inline, so Token Observe is a single point of failure in the agent request path. If it is unavailable, the fleet stops.

  That is a design decision, the same one that makes it fail closed: the governance evaluator returns allow only when every gate passes, and missing, unresolvable or erroring state denies the request, because a control you can bypass by turning it off is not a control. The consequence is that Token Observe's own availability becomes a governance property rather than only an operations one — which is why timeouts, provider circuit breakers and restore-tested backups are treated here as security work, and why a deployment that is serving traffic happily but has stopped recording it is the highest severity in the support model rather than a middling one. Read it beside the two entries above, because they compound: there is no availability service level to hold anyone to when it happens, and there is no second node to fail over to.

This paragraph is the short version of that list. Token Observe is wrong for you today if you need an availability service level, a SOC 2 report or an ISO certificate in the file before you can sign, or more than one node — and it is wrong for you this month if what you need is a tool that discovers subscriptions nobody exported, one blended number for the whole AI bill, a per-request ceiling that bites on a subscription seat, a way to read what staff typed into a browser chat window, or a switch that cancels the vendor's billing rather than stopping the agents. Every one of those is above, at its own anchor, with the reason it is that way. We will say so on the first call.

There is no availability SLA, no uptime percentage and no service credits. The cloud pilot has one replica, shared resource and traffic quotas, and no completed live customer capacity or recovery qualification. For customer-hosted installations, three additional limits explain this position. First, Tenhaw does not operate your deployment: you control the host, the network, the TLS terminator, the disk and the restart policy, and an uptime number from a party with access to none of those, receiving no telemetry from them, would be unmeasurable by either side. Second, no retained partner-shaped sustained-load result exists. A bounded mixed-journey soak harness exercises allow, block, approval and read paths, and the older laboratory throughput probe establishes an order of magnitude for a loopback mock-provider path, but the evidence a commitment would need is a retained multi-hour run against your corpus, your concurrency, your policies and your provider latency, with an agreed degradation curve. Third, recovery automation exists while partner RPO and RTO proof does not: the release workflow boots the packaged image, takes and restores a live backup and checks the restored chain against externally retained values, and recovery is SQLite full-snapshot restore rather than point-in-time recovery, with backup scheduling, off-box placement, retention and freshness alerting all operator-owned. Two consequences matter to anyone assessing this risk: Token Observe is deliberately in the request path and fails closed, so if it is down, governed agents cannot call models and it is a single-writer process on one node by design at this scale, with no replica, no clustering and no high-availability story. An availability or performance commitment becomes possible once the partner-shaped load and recovery results are retained and approved. Until then no number is offered, because nobody could stand behind one. Ask for the date; it is a fair thing to put in an agreement.

The published customer-hosted licence is a draft requiring legal review. Your signed agreement sets the final terms.

The three published reasons there is no availability service level are above; the support severities and the response targets behind them are on the pricing page, and the framework mappings with a stated coverage level on every row are on the compliance page.