SOX cost control architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · SOX · layout matrix_first · implementation executed in CI before publish

The control that resolves this is a Pre-Flight Budget Governor, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is SOX, and the question it actually asks is can an AI-influenced number in a filing be traced and reproduced. The shape below holds p95 ≤ 900ms over gRPC with mTLS, and ships with a standard-library implementation that runs as written.

Enterprise implementation parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Controls and acceptance parameters

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Why this blocks production

LLM spend is discovered in a monthly invoice and defended with a dashboard, so it is reported rather than controlled. Finance asks for a per-team cap and engineering cannot implement one, because nothing in the request path knows a budget exists.

What SOX specifically requires

SOX cares about the integrity of financial reporting. If a model output touches a number that reaches a filing, the control question is whether that output can be reproduced exactly and attributed to a reviewed, approved version.

The artifact that satisfies it is reproducible output records pinned to a model version. The way teams most often fail it: a model upgrade changing a reported figure with no record of which version produced the original.

Implementation components

1. Conservative estimator — Deliberately over-estimates; under-estimating makes the ceiling decorative.
2. Two-phase budget — Reserve the estimate, settle the actual — closes the concurrency race.
3. Rate table in config — Prices change; a stale rate in code silently misprices every chargeback.
4. Tier router — Routes to the cheapest tier that meets the quality bar for the task.
5. Chargeback ledger — Per-tenant, per-request actuals — the artifact finance reconciles against.
6. Fail-closed default — A tenant with no budget is refused, never admitted.

The request path

Pre-Flight Budget Governor — the request path, with the decision points that must exist before the first model call:

flowchart LR
    REQ[Request] --> EST[Conservative token estimate]
    EST --> PR[Price at tier rate]
    PR --> RES{Reserve against budget<br/>spent + outstanding + projected}
    RES -->|over ceiling| REJ[429 BudgetExceeded]
    RES -->|no budget| FC[Refuse - fail closed]
    RES -->|ok| TR[Tier router<br/>cheapest tier meeting quality bar]
    TR --> M[Model call]
    M --> ST[Settle actual usage]
    ST --> LED[(Chargeback ledger)]
    LED --> FIN[Finance reconciliation]

The implementation — Two-phase token budget with per-tenant chargeback

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind gRPC with mTLS; the failure mode it guards against is a half-open HTTP/2 stream silently dropping the deadline. The output you hand the assessor is the reporting-period reproducibility record.

"""Pre-flight token budget enforcement with per-tenant chargeback.

Why this shape: LLM spend is discovered monthly in an invoice and defended with
a dashboard, which means it is never actually controlled. The control has to run
BEFORE the call, on an estimate, with a hard ceiling per tenant and per period —
otherwise the first thing finance asks for is a cap you cannot implement.
"""
import math
import time
from dataclasses import dataclass, field


# USD per 1k tokens. Keep rates in config, not code: they change, and a stale
# rate silently misprices every chargeback downstream of it.
RATES = {
    "frontier":  {"in": 0.0030, "out": 0.0150},
    "mid":       {"in": 0.0008, "out": 0.0040},
    "small":     {"in": 0.0001, "out": 0.0004},
}


def estimate_tokens(text: str, chars_per_token: float = 3.8) -> int:
    """Deliberately a conservative OVER-estimate.

    Under-estimating defeats the purpose: the request gets admitted, the real
    usage exceeds the budget, and the ceiling is decorative."""
    return max(1, math.ceil(len(text or "") / chars_per_token))


def price(tier: str, tokens_in: int, tokens_out: int) -> float:
    r = RATES[tier]
    return (tokens_in / 1000.0) * r["in"] + (tokens_out / 1000.0) * r["out"]


class BudgetExceeded(Exception):
    def __init__(self, tenant, projected, ceiling):
        self.tenant, self.projected, self.ceiling = tenant, projected, ceiling
        super().__init__(f"{tenant}: ${projected:.4f} would exceed "
                         f"${ceiling:.2f} for the period")


@dataclass
class Budget:
    ceiling_usd: float
    period_seconds: float = 86400.0
    spent_usd: float = 0.0
    started: float = field(default_factory=time.time)
    committed: dict = field(default_factory=dict)   # request_id -> reserved USD

    def _roll(self, now):
        if now - self.started >= self.period_seconds:
            self.started, self.spent_usd = now, 0.0
            self.committed.clear()

    def reserve(self, request_id: str, projected_usd: float, now=None) -> float:
        """Two-phase: reserve the estimate, settle the actual.

        Without a reservation, N concurrent requests each see the same low
        `spent` and all get admitted — the classic race that blows a cap."""
        now = time.time() if now is None else now
        self._roll(now)
        outstanding = sum(self.committed.values())
        if self.spent_usd + outstanding + projected_usd > self.ceiling_usd:
            raise BudgetExceeded("tenant",
                                 self.spent_usd + outstanding + projected_usd,
                                 self.ceiling_usd)
        self.committed[request_id] = projected_usd
        return projected_usd

    def settle(self, request_id: str, actual_usd: float):
        self.committed.pop(request_id, None)
        self.spent_usd += actual_usd

    def release(self, request_id: str):
        self.committed.pop(request_id, None)


class Governor:
    def __init__(self):
        self.budgets: dict = {}
        self.ledger: list = []

    def set_budget(self, tenant: str, ceiling_usd: float, period_seconds=86400.0):
        self.budgets[tenant] = Budget(ceiling_usd, period_seconds)

    def admit(self, tenant: str, request_id: str, prompt: str,
              tier: str = "mid", max_output_tokens: int = 1024) -> dict:
        b = self.budgets.get(tenant)
        if b is None:
            raise KeyError(f"{tenant} has no budget: fail closed, never open")
        t_in = estimate_tokens(prompt)
        projected = price(tier, t_in, max_output_tokens)
        b.reserve(request_id, projected)
        return {"tenant": tenant, "request_id": request_id, "tier": tier,
                "tokens_in_est": t_in, "projected_usd": round(projected, 6)}

    def record(self, tenant: str, request_id: str, tier: str,
               tokens_in: int, tokens_out: int) -> dict:
        actual = price(tier, tokens_in, tokens_out)
        self.budgets[tenant].settle(request_id, actual)
        row = {"tenant": tenant, "request_id": request_id, "tier": tier,
               "tokens_in": tokens_in, "tokens_out": tokens_out,
               "actual_usd": round(actual, 6), "ts": time.time()}
        self.ledger.append(row)     # this is the chargeback record
        return row


if __name__ == "__main__":
    g = Governor()
    g.set_budget("bank-eu", ceiling_usd=0.05)
    adm = g.admit("bank-eu", "req-1", "Reconcile these 400 journal lines." * 20)
    print("admitted:", adm)
    print("settled :", g.record("bank-eu", "req-1", "mid", adm["tokens_in_est"], 310))
    try:
        for i in range(40):
            g.admit("bank-eu", f"burst-{i}", "x" * 4000, tier="frontier")
    except BudgetExceeded as e:
        print("ceiling held:", e)

The SOX control, as code

Segregation of duties over model releases. This is the artifact an assessor asks for under SOX specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Segregation of duties over model releases, with an immutable approval chain.

SOX cares about change management over systems affecting financial reporting.
The control that fails is the one where the person who wrote the change also
approved and deployed it, and where the approval record can be edited after the
fact. Both are structural, so both are enforced here rather than reviewed.
"""
import hashlib
import json


class ApprovalChain:
    """Append-only. Each link commits to the previous digest, so an edited
    record breaks verification rather than quietly rewriting history."""

    def __init__(self):
        self.links: list[dict] = []

    def _head(self) -> str:
        return self.links[-1]["digest"] if self.links else "genesis"

    def append(self, action: str, actor: str, change_id: str) -> dict:
        body = {"action": action, "actor": actor, "change_id": change_id,
                "prev": self._head()}
        digest = hashlib.sha256(
            json.dumps(body, sort_keys=True).encode()).hexdigest()
        link = dict(body, digest=digest)
        self.links.append(link)
        return link

    def verify(self) -> bool:
        prev = "genesis"
        for link in self.links:
            body = {k: link[k] for k in ("action", "actor", "change_id", "prev")}
            if link["prev"] != prev:
                return False
            if hashlib.sha256(
                    json.dumps(body, sort_keys=True).encode()).hexdigest() != link["digest"]:
                return False
            prev = link["digest"]
        return True

    def actors(self, change_id: str, action: str) -> set[str]:
        return {l["actor"] for l in self.links
                if l["change_id"] == change_id and l["action"] == action}


class ReleaseGate:
    def __init__(self, chain: ApprovalChain):
        self.chain = chain

    def author(self, change_id: str, actor: str) -> None:
        self.chain.append("author", actor, change_id)

    def approve(self, change_id: str, actor: str) -> None:
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(
                f"{actor} authored {change_id}; approval requires a second person")
        self.chain.append("approve", actor, change_id)

    def deploy(self, change_id: str, actor: str) -> dict:
        if not self.chain.actors(change_id, "approve"):
            raise PermissionError(f"{change_id} has no approval")
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(f"{actor} authored {change_id}; cannot deploy it")
        return self.chain.append("deploy", actor, change_id)


if __name__ == "__main__":
    chain = ApprovalChain()
    gate = ReleaseGate(chain)

    gate.author("MODEL-2026-114", "r.khare")
    try:
        gate.approve("MODEL-2026-114", "r.khare")
        raise AssertionError("self-approval was permitted")
    except PermissionError:
        pass

    gate.approve("MODEL-2026-114", "a.controller")
    try:
        gate.deploy("MODEL-2026-114", "r.khare")
        raise AssertionError("author deployed their own change")
    except PermissionError:
        pass

    link = gate.deploy("MODEL-2026-114", "o.release")
    assert chain.verify(), "chain must verify after a legitimate sequence"
    assert link["action"] == "deploy"

    try:
        gate.deploy("MODEL-2026-999", "o.release")
        raise AssertionError("deployed an unapproved change")
    except PermissionError:
        pass

    # Tampering must be detectable, not merely discouraged.
    chain.links[1]["actor"] = "r.khare"
    assert not chain.verify(), "edited approval record still verified"

    print("SOX segregation of duties + approval chain: OK")
    print(f"  links {len(chain.links)}, verifies_after_tamper={chain.verify()}")

Control questions before sign-off

• Reproduce last quarter's figure exactly, using the model version that produced it.
  Version, prompt digest and output digest are recorded per reporting-relevant inference, and versions are pinned per period, so the figure is reproducible on demand.
• What refuses a request that would exceed this team's monthly cap, and where in the path does it run?
  The budget governor, at admission — before the model call. It prices a conservative token estimate against the tenant's remaining ceiling and refuses the request if the projection would exceed it.
• If 50 requests arrive at once against a nearly-exhausted budget, how many are admitted?
  Only those that fit. Admission counts outstanding reservations as well as settled spend, which closes the race where concurrent requests all read the same low figure and are all admitted.
• How does your chargeback figure reconcile to the provider invoice, and what is the variance?
  The chargeback ledger records per-request actuals priced from a versioned rate table with an effective date; reconcile it monthly and track the variance against the provider invoice.
• What happens to a tenant with no budget configured?
  It is refused. A missing budget fails closed — admitting an unbudgeted tenant is how the cap becomes decorative.
• Which rate table priced last month's chargeback, and when was it last updated?
  The rate table in versioned config, with its effective date recorded. A rate older than 90 days raises an alert, because a stale rate silently misprices every chargeback downstream.

Related architectures

• Part of enterprise llm cost control.
• SOX prompt injection defence architecture for enterprise LLM deployment applies the same mechanism under a different obligation.
• SOX tracing and token accounting architecture for enterprise LLM covers the adjacent case.
• SOX reference architecture for enterprise LLM deployment at scale covers the adjacent case.
• A different failure mode of the same component: SOX audit evidence architecture for enterprise LLM deployment.
• If this is the blocker in front of you: enterprise AI infrastructure review.