Skip to content

AI Usage Tracking

Model usage priced as it happens, and governed by the same budget as everything else.

Overview

As organizations adopt AI services across AWS, Azure, and GCP, tracking usage and cost becomes critical. According to the FinOps Foundation's State of FinOps 2026, 98% of FinOps teams now manage AI spend, up from 31% in 2024.

AI spend is awkward for conventional cost tooling. There is no long-running resource to observe, just calls that cost money, and billing data arrives well after the calls were made. RosettaOps handles it as an event stream rather than as a line on a bill.

How It Works

Every account forwards Bedrock invocation events (InvokeModel, Converse, and RetrieveAndGenerate) to your audit account, where the Monitoring Service consumes them. Usage is priced in weighted units, output weighted more heavily than input, and added to that account's live cost, within five minutes of the call. When an account's budget is reached, its AI access is cut within 15 minutes, together with everything else on the account.

flowchart LR
    Sub["Member accounts<br/><i>Bedrock calls</i>"] -->|"invocation events"| Audit["Audit account<br/><i>Monitoring Service</i>"]
    Audit -->|"priced, weighted"| Cost["Account live cost"]
    Cost -->|"budget exhausted"| Stop["New launches blocked<br/>at the cloud's API"]

    style Sub fill:#f5f5f5,stroke:#616161,color:#000
    style Audit fill:#e3f2fd,stroke:#1565c0,color:#000
    style Cost fill:#e8f5e9,stroke:#2e7d32,color:#000
    style Stop fill:#fff3e0,stroke:#e65100,color:#000

Model spend is governed by the account budget, the same ceiling as compute and storage, rather than by a parallel mechanism. That is the point of pricing it live: an AI workload draws down the same budget as everything else, while it is running, and the same enforcement stops it.

Available Today

Capability Description
Real-time token metering Bedrock invocations captured org-wide through CloudTrail data events and priced within five minutes of the call
Cost against budget AI spend is added to the account's live cost and enforced by the account budget, alongside all other spend
Model access by role Which models a role may call is managed through RosettaHub roles
Denial at the cloud's own policy layer A role that may not call a model is translated into a denial the cloud enforces itself, so the restriction holds for every principal in the account, not only those going through RosettaHub
Per-project restrictions Different projects can be granted different model access
Alarms on AI-enabled accounts Accounts with Bedrock enabled are monitored automatically
Federated Bedrock access Users reach Bedrock through sandboxed cloud accounts, inside their own budget and permissions
Token audit trail Full record of model usage by user, by account and over time
AgentCore agents Agents running on Amazon Bedrock AgentCore are tracked like any other Bedrock usage

Bedrock today

The metering pipeline described above is implemented for AWS Bedrock. Usage on other providers is covered by the account budget in the ordinary way, through their billing data, without per-call token pricing.

Not Enforced Today

Being clear about the boundary is more useful than a roadmap date.

Capability Status
Token-level quotas Not enforced. Usage is metered and priced continuously, and the account budget is what stops spend. A quota capping model calls independently of cost is a separate mechanism we do not have yet
Rate limiting Not available
Approval workflows Not available
Per-call metering on other providers Bedrock only, as above

By Edition

Edition Capability
Observe Real-time token metering, AI cost visible against the account's live cost, audit trail
Govern Everything in Observe, plus the account budget stopping spend, and model access controlled by role and enforced at the cloud's own policy layer
Automate Everything in Govern. Acting on resources after the fact adds nothing specific to AI

RosettaOps AI Agents

RosettaHub is building MCP-powered agents that give natural-language access to cloud operations from the desktop application:

Agent domain What it automates
CloudOps Infrastructure provisioning, scaling, and lifecycle management
FinOps Budget optimization, cost investigation, savings recommendations
DevOps Formation CI/CD, image pipeline automation

These use the Model Context Protocol to reach RosettaHub's APIs. The MCP server is available today; the agent layer above it is in development.

Why This Matters

A single misconfigured automation can run up a large bill in model calls within hours. Cost tooling that reads billing data finds out the next day, and until recently AWS's billing data did not break Bedrock down per principal at all.

Pricing the calls as they happen means AI spend is subject to the same budget that governs everything else, at the moment it is being spent rather than after the fact.