Cloud AI spend: who can see it, and what is never stored¶
Technical version: WING-193 cloud AI finance and usage contract
Status: planned and locked as a contract. Do not treat a live finance dashboard as shipped until tenant auth and role enforcement exist.
Who gets the finance view¶
Only a server-verified finance role, assigned for the person who needs billing oversight (Pam in the current plan). Having a YC or team invitation, owning a workspace, matching an email domain, or holding a claim only in the browser does not grant finance access. Alerts can go to Andrew without automatically opening the dashboard.
What the ledger is allowed to hold¶
One aggregate row per provider, model, feature, audience, and day: token counts, calculated dollars, pricing version, and a pseudonymous workspace id for finance use.
It must not hold prompts, résumé facts, generated text, API keys, OAuth tokens, request bodies, filenames, job titles, or employer names.
Features blocked for YC may record only a content-free “blocked attempt” count. If no provider call happens, no cost is invented.
What the dashboard is for¶
- Actual spend broken down by day / provider / model / feature / audience
- Prepaid balance only when a provider officially exposes it (otherwise “Not available,” never fake zero)
- Forecast with method and uncertainty labeled
- Remaining application budget and anomaly flags
Hard server-side daily and monthly caps block dispatch when crossed. The client cannot override them. Alerts at budget thresholds go privately by email/Slack with aggregate spend only — never user content.
Cloud provider billing alerts (for example GCP) are a separate infrastructure signal. They do not replace application hard caps.