Chapter 4 of 6
Decisions and stop conditions#
Allocation scope#
Use one approved AI subscription. The Bicep deployment runs at subscription scope, and the tag assignments also land at that subscription scope. Preflight rejects resource-group or narrower target scopes.
The resource-group tag requirement is staged in DoNotEnforce first. It reaches Default only after the policy owner reviews current findings, exemptions, and the subscription-wide effect.
Stop if the subscription is production without approval, if the subscription holds unrelated resource-group creation paths that have not accepted the tag requirement, or if the tag taxonomy does not include CostCenter.
Budget filters#
The cost owner approves the budget name, amount, start and end dates, actual and forecasted thresholds, notification email, action group, resource group filters, and meter-category filters.
Stop if a meter category is guessed. Confirm it in Cost analysis or the price sheet before you deploy. A budget notification is not a spend cap and must not be described as one.
Gateway dimensions and quota#
Use at most five custom dimensions in the APIM token metric. Keep them low-cardinality. This module uses cost center, consumer, product, API, and model route. Cost center comes from the approved APIM product mapping. Consumer comes from the APIM subscription ID. Model route is a static alias set by the gateway owner. Unknown products map to one fixed value.
Do not use request headers, user ID, email, prompt text, conversation ID, request ID, or free text as a chargeback metric dimension.
Stop if traffic can bypass the gateway route, if a product has no owner, if a quota would block a shared product without an approved response path, if a caller can set its own cost center, or if streaming clients cannot supply token usage where the backend needs include_usage.
Rate table#
Finance owns the token-to-cost table. Record the currency, effective date, model alias, token-rate basis, owner, and reconciliation cadence. Cost Management remains the billed source.
Stop if rates are not approved, if the model alias in the query does not match logged model names, or if someone wants to treat estimated token cost as the invoice.