--- title: "Solution: IT leadership (by role)" canonical_url: "https://tokenobserve.com/solutions/it-leadership" published: 2026-09-07 last_updated: 2026-10-21 --- # Solution: IT leadership (by role) Know which teams use which AI tools, what they cost and who approved them. ## The argument Token Observe puts a vendor, a tool, a team and a named owner on every AI subscription and API account your business pays for. You record what was billed by mapping the charge lines out of your own finance export onto an import template with ten required columns and two optional columns, as CSV in the dashboard (previewed before anything commits) or the same fields as JSON. The import path needs no billing credential or vendor console login. Metered estimates stay a separate number, because a charge and an estimate are different measurements. Every entry holds one of three authorization states (approved, prohibited or unknown, with unknown the default), and coverage is reported on its own axis, so an unconnected source reads as unknown rather than as zero. ## Facts - What you give it: Your vendor list, and your finance export mapped onto the import template - How the money reads: Billed per currency, subscription apart from API, estimates never added in - Register states: Approved, prohibited or unknown; unknown is the default - Where it runs: Cloud pilot workspace; optional customer hosting with separate operating requirements ## The limit What an import cannot find: An invoice import finds what the invoice lists; nothing here discovers a subscription on its own ## What this reader is under pressure about - The follow-up questions need more detail: A total starts the conversation. To explain a change, you need the teams, tools and approval decisions behind it. - The register and the approvals live in different places: The subscriptions live in a spreadsheet. An approval is somewhere in an email thread. Putting them together gives your team a record they can keep current. - Agents are already spending on somebody's key: A process in engineering is calling a model on a key belonging to a person rather than to the business, and the cost lands at month end. A USD ceiling that refuses the call before egress is a different control from a dashboard reporting it afterwards. ## What this reader asks, and the answer Q: What is this going to cost us? A: The cloud trial is free for 30 days from workspace creation, with no card or automatic paid conversion. Provider model calls, model-assisted search and Google BigQuery scans can incur separate charges. Paid cloud prices are not published. At expiry, workspace changes, model calls and scheduled billing collection stop; authorised retained reads and exports remain subject to the shared traffic quota. Customer-hosted licensing and design-partner work are scoped separately. Q: How long before it tells me something I do not already know? A: Register the subscriptions you already know about against a vendor, tool, team and owner, then map last month's finance export onto the import template and load it, as CSV through the dashboard (previewed before anything commits) or the same fields as JSON. The report then tells you what was billed per currency, which team it belongs to and whose name is on it. No time-to-value figure is published, because none has been measured on a customer's estate. Q: Who else is running this? A: Nobody yet. There are no reference customers, no logos and no case studies, and we will not produce one for a first call. Broad general availability is a published no-go decision, which is what the Early access badge means. If that rules us out, it is better to know now. Q: I am not installing employee surveillance on my own staff. A: Then do not, and this is not that. An approved, paid subscription is legitimate usage and is never reported as unauthorised use. The scope is narrower than it sounds, because the register is consulted in exactly one detector, per-user seat spend. A network egress export you supply names a source host and a destination host, which is not a verified employee identity and cannot establish what was typed. Conversation capture is off by default. ### Start with your vendor list and finance export. You write down the subscriptions you already know about, against a vendor, tool, team and owner email. Then you map the charge lines out of the export finance produces onto the import template with ten required columns and two optional columns, and the dashboard shows you the parsed lines before anything commits. The import path uses no billing connector or vendor admin credential. - Import bounds: Ten required columns, 1,000 lines and 2 MiB. Unknown fields, credentials in metadata, inconsistent attribution and invalid periods are rejected outright. - Built to be run every month: Identity is team, source and external id together. Reimporting the same invoice adds nothing; reusing an identity with different data returns a conflict and rolls the whole import back. - Refusals are recorded like the successes: A request refused at a ceiling produces the same evidence as one that ran, so month-end shows every decision, with no gap in the record. ### It does not tell you what your staff typed. The register records decisions about services, attributed to a team and an owner email: the person accountable for the subscription, not the person typing into it. An approved entry suppresses the matching seat-spend finding, so staff using a tool the business already pays for stop appearing on a report as though they had done something wrong. - Capture off, or capture bounded: The default mode stores no message text. Switched to redacted, the prompt as sent and the assistant's reply are both kept, mask-redacted before truncation and bounded. - The seat census is the exception: It holds employees by name, and it sits outside both the trace retention window and subject erasure. Put that in front of whoever advises you on data protection. ## The capabilities that matter most to this reader, in order - https://tokenobserve.com/platform/estate-spend - https://tokenobserve.com/platform/approved-ai - https://tokenobserve.com/platform/agent-registry - https://tokenobserve.com/platform/conversation-evidence - https://tokenobserve.com/platform/spend-controls ## Questions and answers Q: We already pay Microsoft and Google for AI. Why another tool? A: Keep them. Token Observe adds one register spanning every vendor you buy from, with a vendor, a tool, a team and a named owner on every entry and one of three states against it. It records what you were billed per currency, with subscription and API charges kept apart and metered estimates never folded in, and reports coverage as its own axis. Q: Do we need a vendor admin credential to import invoices? A: Cloud billing connections require the provider's administrative or reporting credential. The separate invoice-import path needs no billing credential: you map an export you hold onto its import template. Two scheduled pull connectors are available separately: GitHub Copilot and Cisco Umbrella, each on a narrow read-scoped credential you supply and can withhold. Q: Will it cancel a subscription nobody is using? A: No. It records the decision and names the owner; only the vendor can end the seat. Marking a service prohibited classifies later evidence accordingly; it does not stop anyone opening that tool in a browser or reclaim a licence from somebody who left. What changes is that the cancellation conversation has a named owner and an invoice line attached.