SOX tracing and token accounting architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · SOX · layout diagram_first · implementation executed in CI before publish

The control that resolves this is a Complete-Trace Reconciliation Ledger, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is SOX, and the question it actually asks is can an AI-influenced number in a filing be traced and reproduced. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The request path

Complete-Trace Reconciliation Ledger — the request path, with the decision points that must exist before the first model call:

flowchart LR
    REQ[Request] --> OPEN[Open trace<br/>model version pinned]
    OPEN --> CTX[Bind prompt digest + sources]
    CTX --> CALL[Model call] --> OUT[Bind output digest + tokens]
    OUT --> LED[(Ledger)]
    BILL[Provider invoice] --> REC{Reconcile}
    LED --> REC
    REC -->|gap| ALERT[Untraced traffic — find the path]
    REC -->|matches| OK[Completeness holds]

Modular implementation framework

1. Per-request trace — Model version, prompt digest, output digest, sources, tokens.
2. Completeness check — A trace missing any required field is reported, not accepted.
3. Source citation list — Which retrieved documents were in context for this answer.
4. Token accounting — Input and output tokens recorded at the call site.
5. Spend reconciliation — Traced tokens against billed tokens; a gap means untraced traffic.
6. Reconstruction API — Given a request id, return everything needed to re-derive the answer.

Implementation parameter matrix

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

Why this blocks production

An answer is disputed weeks after it was given and nobody can say which model version, which documents and which prompt produced it. Traces exist, but they are sampled, so the disputed request is the one that was not kept.

What SOX specifically requires

SOX cares about the integrity of financial reporting. If a model output touches a number that reaches a filing, the control question is whether that output can be reproduced exactly and attributed to a reviewed, approved version.

The artifact that satisfies it is reproducible output records pinned to a model version. The way teams most often fail it: a model upgrade changing a reported figure with no record of which version produced the original.

Reference implementation — Trace completeness with spend reconciliation

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the reporting-period reproducibility record.

"""Trace completeness: every response tied to the inputs that produced it.

The failure: an answer is disputed weeks later and nobody can reconstruct which
model version, which retrieved documents and which prompt produced it. Sampling
traces at 1% guarantees the disputed one is missing, so completeness is the
property to enforce — and untraced spend is the signal that it has broken.
"""
import hashlib


class Trace:
    def __init__(self, request_id: str, model_version: str):
        self.request_id = request_id
        self.model_version = model_version
        self.sources: list[str] = []
        self.prompt_digest = None
        self.output_digest = None
        self.tokens = {"in": 0, "out": 0}

    def bind_prompt(self, prompt: str) -> None:
        self.prompt_digest = hashlib.sha256(prompt.encode()).hexdigest()[:16]

    def bind_output(self, output: str) -> None:
        self.output_digest = hashlib.sha256(output.encode()).hexdigest()[:16]

    def cite(self, source_id: str) -> None:
        self.sources.append(source_id)

    def complete(self) -> bool:
        return all([self.prompt_digest, self.output_digest,
                    self.model_version, self.tokens["in"] > 0])

    def missing(self) -> list[str]:
        gaps = []
        if not self.prompt_digest: gaps.append("prompt_digest")
        if not self.output_digest: gaps.append("output_digest")
        if not self.model_version: gaps.append("model_version")
        if self.tokens["in"] <= 0: gaps.append("token_accounting")
        return gaps


class Ledger:
    """Reconciles traced spend against billed spend. A gap means requests are
    escaping the traced path, which is the thing to find — not a rounding
    error to tolerate."""

    def __init__(self, tolerance: float = 0.01):
        self.traces: dict[str, Trace] = {}
        self.tolerance = tolerance

    def open(self, request_id: str, model_version: str) -> Trace:
        t = Trace(request_id, model_version)
        self.traces[request_id] = t
        return t

    def reconstruct(self, request_id: str) -> dict | None:
        t = self.traces.get(request_id)
        if not t:
            return None
        return {"request_id": t.request_id, "model_version": t.model_version,
                "prompt_digest": t.prompt_digest, "output_digest": t.output_digest,
                "sources": list(t.sources), "tokens": dict(t.tokens),
                "complete": t.complete(), "missing": t.missing()}

    def traced_tokens(self) -> int:
        return sum(t.tokens["in"] + t.tokens["out"] for t in self.traces.values())

    def reconcile(self, billed_tokens: int) -> dict:
        traced = self.traced_tokens()
        gap = billed_tokens - traced
        ratio = gap / billed_tokens if billed_tokens else 0.0
        return {"traced": traced, "billed": billed_tokens, "gap": gap,
                "untraced_ratio": round(ratio, 4),
                "within_tolerance": abs(ratio) <= self.tolerance,
                "incomplete_traces": [r for r, t in self.traces.items()
                                      if not t.complete()]}


if __name__ == "__main__":
    led = Ledger()
    t = led.open("req-1", "gpt-x@2026-09")
    t.bind_prompt("What is our refund policy?")
    t.cite("doc://policies/refunds#v7")
    t.tokens = {"in": 820, "out": 240}
    t.bind_output("Refunds are processed within 14 days.")

    rec = led.reconstruct("req-1")
    assert rec["complete"], rec
    assert rec["sources"] == ["doc://policies/refunds#v7"], rec
    assert rec["model_version"] == "gpt-x@2026-09"

    # An incomplete trace must be visible, not silently acceptable.
    t2 = led.open("req-2", "gpt-x@2026-09")
    t2.tokens = {"in": 100, "out": 50}
    assert not t2.complete() and "prompt_digest" in t2.missing(), t2.missing()

    clean = led.reconcile(billed_tokens=1210)
    assert clean["within_tolerance"], clean
    assert clean["incomplete_traces"] == ["req-2"], clean

    # Requests escaping the traced path show up as an untraced gap.
    leaky = led.reconcile(billed_tokens=4000)
    assert not leaky["within_tolerance"], leaky
    assert leaky["untraced_ratio"] > 0.6, leaky

    assert led.reconstruct("req-missing") is None

    print("Trace completeness ledger: OK")
    print(f"  reconstructed req-1 complete={rec['complete']}, "
          f"untraced ratio clean={clean['untraced_ratio']} "
          f"leaky={leaky['untraced_ratio']}")

The SOX control, as code

Segregation of duties over model releases. This is the artifact an assessor asks for under SOX specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Segregation of duties over model releases, with an immutable approval chain.

SOX cares about change management over systems affecting financial reporting.
The control that fails is the one where the person who wrote the change also
approved and deployed it, and where the approval record can be edited after the
fact. Both are structural, so both are enforced here rather than reviewed.
"""
import hashlib
import json


class ApprovalChain:
    """Append-only. Each link commits to the previous digest, so an edited
    record breaks verification rather than quietly rewriting history."""

    def __init__(self):
        self.links: list[dict] = []

    def _head(self) -> str:
        return self.links[-1]["digest"] if self.links else "genesis"

    def append(self, action: str, actor: str, change_id: str) -> dict:
        body = {"action": action, "actor": actor, "change_id": change_id,
                "prev": self._head()}
        digest = hashlib.sha256(
            json.dumps(body, sort_keys=True).encode()).hexdigest()
        link = dict(body, digest=digest)
        self.links.append(link)
        return link

    def verify(self) -> bool:
        prev = "genesis"
        for link in self.links:
            body = {k: link[k] for k in ("action", "actor", "change_id", "prev")}
            if link["prev"] != prev:
                return False
            if hashlib.sha256(
                    json.dumps(body, sort_keys=True).encode()).hexdigest() != link["digest"]:
                return False
            prev = link["digest"]
        return True

    def actors(self, change_id: str, action: str) -> set[str]:
        return {l["actor"] for l in self.links
                if l["change_id"] == change_id and l["action"] == action}


class ReleaseGate:
    def __init__(self, chain: ApprovalChain):
        self.chain = chain

    def author(self, change_id: str, actor: str) -> None:
        self.chain.append("author", actor, change_id)

    def approve(self, change_id: str, actor: str) -> None:
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(
                f"{actor} authored {change_id}; approval requires a second person")
        self.chain.append("approve", actor, change_id)

    def deploy(self, change_id: str, actor: str) -> dict:
        if not self.chain.actors(change_id, "approve"):
            raise PermissionError(f"{change_id} has no approval")
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(f"{actor} authored {change_id}; cannot deploy it")
        return self.chain.append("deploy", actor, change_id)


if __name__ == "__main__":
    chain = ApprovalChain()
    gate = ReleaseGate(chain)

    gate.author("MODEL-2026-114", "r.khare")
    try:
        gate.approve("MODEL-2026-114", "r.khare")
        raise AssertionError("self-approval was permitted")
    except PermissionError:
        pass

    gate.approve("MODEL-2026-114", "a.controller")
    try:
        gate.deploy("MODEL-2026-114", "r.khare")
        raise AssertionError("author deployed their own change")
    except PermissionError:
        pass

    link = gate.deploy("MODEL-2026-114", "o.release")
    assert chain.verify(), "chain must verify after a legitimate sequence"
    assert link["action"] == "deploy"

    try:
        gate.deploy("MODEL-2026-999", "o.release")
        raise AssertionError("deployed an unapproved change")
    except PermissionError:
        pass

    # Tampering must be detectable, not merely discouraged.
    chain.links[1]["actor"] = "r.khare"
    assert not chain.verify(), "edited approval record still verified"

    print("SOX segregation of duties + approval chain: OK")
    print(f"  links {len(chain.links)}, verifies_after_tamper={chain.verify()}")

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Questions to answer before approval

• Reproduce last quarter's figure exactly, using the model version that produced it.
  Version, prompt digest and output digest are recorded per reporting-relevant inference, and versions are pinned per period, so the figure is reproducible on demand.
• A customer disputes an answer from six weeks ago. What can you reconstruct?
  The model version, prompt digest, output digest, the retrieved sources in context, and token counts — enough to re-derive the answer rather than argue about it.
• How would you know if some requests never reach the traced path?
  Reconciliation. Traced token spend is compared against the provider invoice; a gap beyond tolerance means traffic is escaping the traced path, and that gap is the thing to chase.
• Which model version produced a specific output, and how is that known rather than inferred?
  It is pinned on the trace when the trace opens, before the call. Inferring it afterwards from deployment history is exactly how the wrong version gets attributed.
• Does the trace store the raw prompt, and what does that mean for personal data?
  Digests by default, with raw retained only where there is a lawful basis. The digest is enough to prove which prompt produced which output without storing the text.
• What does tracing add to the latency of the request it traces?
  Nothing on the critical path: trace writes are buffered and asynchronous, and the added p95 is measured against the agreed budget rather than assumed to be negligible.

Related reference architectures

• Part of enterprise ai compliance architecture.
• This pattern also governs SOX retrieval architecture with citation integrity for enterprise LLM.
• SOX data governance framework for enterprise LLM deployment applies the same mechanism under a different obligation.
• SOX agent permission and delegated access architecture for enterprise LLM applies the same mechanism under a different obligation.
• A different failure mode of the same component: SOX provider failover and degradation architecture for enterprise LLM.
• If this is the blocker in front of you: enterprise AI infrastructure review.