AI cost allocation, budgets, and gateway token chargeback

Chapter 5 of 6

Implement#

1. Complete the retained records#

Update:

• artifacts/finance/chargeback-decisions.json
• artifacts/finance/token-rate-table.json
• artifacts/policy/tag-allocation.bicepparam
• artifacts/cost/ai-budget-with-filters.bicepparam
• artifacts/apim/token-chargeback-policy.xml
• artifacts/queries/token-chargeback.kql

Use the same target scope, APIM product IDs, token quota, and model aliases across the files.

2. Run preflight#

$targetScope = "/subscriptions/<approved-subscription-id>"
$deploymentLocation = "<approved-region>"

.\scripts\preflight.ps1 `
  -TargetScope $targetScope `
  -DeploymentLocation $deploymentLocation

target_scope="/subscriptions/<approved-subscription-id>"
deployment_location="<approved-region>"

./scripts/preflight.sh \
  --target-scope "$target_scope" \
  --deployment-location "$deployment_location"

Preflight rejects unresolved decisions, missing files, invalid JSON, invalid XML, a non-subscription target scope, a mismatch between TargetScope and approvedSubscriptionId, user-level or client-supplied token dimensions, a missing CostCenter tag, a missing product quota, and a missing rate row. After those checks pass, it builds the Bicep files and runs subscription what-if for the tag policy and budget deployments.

3. Deploy the tag policies#

Deploy the policy assignments after the policy owner approves the what-if result.

az deployment sub create `
  --location $deploymentLocation `
  --name "ai-finops-tag-allocation" `
  --parameters .\artifacts\policy\tag-allocation.bicepparam `
  --only-show-errors

az deployment sub create \
  --location "$deployment_location" \
  --name "ai-finops-tag-allocation" \
  --parameters ./artifacts/policy/tag-allocation.bicepparam \
  --only-show-errors

After the assignments exist, the policy owner reviews scope, identity, and current policy findings. The resource-group tag requirement is still staged in DoNotEnforce. Promote it to Default only through the approved policy change after the subscription-wide effect is accepted.

Then create remediation tasks for existing AI resources. Use one remediation task per inherit-tag assignment. Do not start remediation until the resource owner accepts the tag effect on existing resources.

4. Deploy the filtered AI budget#

Deploy the budget after the cost owner approves the filters and action group.

az deployment sub create `
  --location $deploymentLocation `
  --name "ai-finops-filtered-budget" `
  --parameters .\artifacts\cost\ai-budget-with-filters.bicepparam `
  --only-show-errors

az deployment sub create \
  --location "$deployment_location" \
  --name "ai-finops-filtered-budget" \
  --parameters ./artifacts/cost/ai-budget-with-filters.bicepparam \
  --only-show-errors

Confirm that the action-group owner knows what automation or notification receives the budget event. The budget does not stop model use.

5. Merge the APIM policy#

The gateway owner merges artifacts/apim/token-chargeback-policy.xml into the customer-owned APIM policy source for the route created in Session 06. Preserve existing authentication, routing, safety, backend, rate-limit, and token-limit controls.

Apply the change through the approved gateway promotion path. If the APIM route already has a product quota, update the existing quota branch instead of creating a second counter for the same product.

6. Run the chargeback query#

Open the approved Application Insights or Log Analytics workspace and run artifacts/queries/token-chargeback.kql. Use the same time range that finance approved for the first check.

The query uses ApiManagementGatewayLlmLog token columns and joins ApiManagementGatewayLogs on CorrelationId for APIM product, subscription, API, and operation fields. It flags rows with missing token counts instead of turning them into zero usage. It must not return prompts, responses, headers, raw request bodies, caller IP, or user identifiers.