Governance and exports¶
This is where attribution becomes a controlled financial and operating output: budgets and policies that govern spend, the FOCUS chargeback export finance can reproduce without Venturi, scheduled reports delivered under each recipient’s own access, and the billing basis your contract is measured on. These surfaces live under the Operate and Optimize navigation groups, and every action here fails closed.
Budgets and governance¶
Governance (Optimize → Governance) is where you define budgets and the
policies that watch them.
- Budgets set a spend limit on a scope: an organization, workspace, team, or project. A budget view shows current spend, the forecast, the threshold state, and the owner, so a budget owner always knows where they stand against their limit.
- Policies are governed objects with a clear lifecycle (draft → active → archived). Publishing or changing a high-impact policy can require a second approver, and rejection requires a reason code from an audited taxonomy.
Governance modes: Passive, Advisory (Shape), Active (Gate)¶
Governance runs in one of three deployment modes, customer-controlled, audit-logged, and reversible. Advisory (Shape) is the default posture, and it is what every account uses during onboarding.
- Passive: observe only. Budgets and policies record state and raise alerts; they take no action on traffic.
- Advisory (Shape) (default): advisory guardrails. A budget or policy raises alerts, informs decisions, and can steer routing recommendations, but it does not block or throttle your production AI traffic.
- Active (Gate-capable): for explicitly opted-in workloads, a policy may emit a signed deny recommendation to an enforcement point that you manage. Venturi’s own proxy never blocks a request in-line, in any mode.
Target-state: Gate enforcement
Gate is never enabled during default onboarding and is never
default-on. It is unavailable unless you explicitly enable it for a
named workload, and only after that workload’s trust readiness reaches
OPERATIONALLY_TRUSTED. Even with Gate enabled, a platform failure
still fails open. Venturi will not become a single point of failure
for your production AI traffic, because the deny is a recommendation your
enforcement point applies, never an in-proxy denial. Gate enforcement is a
target-state control and is not generally available; the default
experience is Shape, which gives you visibility and guardrails, not a kill
switch on your traffic.
Approval thresholds¶
Configurable thresholds determine when an action needs more than one set of eyes:
for example, a budget above a set value escalates from single-approver to
dual-approver, and an override on large spend requires a
second approver. Dependency rules prevent enabling an object whose prerequisites
aren’t met: for instance, publishing a chargeback report while reconciliation is
still estimated is blocked with a labeled reason until it reaches reconciled.
Alerts and notifications¶
Budgets, anomalies, optimization opportunities, dispute-SLA breaches, and connector health all raise alerts. Notifications are delivered through the in-app notification center and your chosen channels: email, Slack, Microsoft Teams, or a signed webhook. Time-bound escalation chains advance an unacknowledged critical alert up the chain (owner → role queue → admin) until someone acknowledges it, respecting your business calendar.
The FOCUS chargeback export¶
The headline export is the FOCUS v1.2-conformant chargeback file: 64
columns (57 base plus 7 Venturi extensions), required cost fields always
present, cost computed on the model actually served, and only chargeback-ready
rows (coper ≥ 0.80) included by default. The canonical treatment (full
column list, API request, scheduling, and the audit-independence contract)
lives in Reporting & exports;
this page covers how the export behaves as a dashboard surface. Each exported
row links back to the evidence that produced it.
Export jobs, durability, and provenance¶
The Exports surface (Operate → Exports) is the queue of every export you’ve
requested. A FOCUS build runs as a background job that survives navigation and
sign-out; its status is server-authoritative throughout
(queued → running → succeeded → failed), and completion fires an in-app
notification plus your chosen channel with a deep link to the finished artifact and
its schema-version manifest. A failed job shows a reason and a retry path, never a
silent disappearance.
Every export records its provenance:
- The requester, and the approver where approval was required;
- The filters and time window;
- The source freshness and method basis (
estimated/reconciled); - The confidence floor applied and the excluded unknowns;
- The file hash and signature metadata.
Exports are governed by role, scope, confidence, residency, and retention. Export creation fails closed: a user without scope sees a permission message naming the determining factor, never another tenant’s data. Any analytic table or saved view also exports to CSV, Excel, or JSON with interpretation-metadata columns, and a dashboard or tile exports to PDF/PNG/CSV with the freshness timestamp and method labels stamped on, so a screenshot is never mistaken for live truth.
Scheduled reports¶
Bind a saved view to a format, a cadence, and a recipient list to create a scheduled report. Each recipient’s copy is rendered under their authorization: a team lead scoped to one team sees only that team; workforce-individual data stays hidden for non-workforce roles; EU rows respect residency; small cohorts stay suppressed. A recipient who loses access simply stops receiving in-scope rows on the next run. Reports run on your business calendar and record every delivery.
What’s included in a chargeback: and what isn’t¶
| Result | In a default chargeback export? | Where it stays visible |
|---|---|---|
deterministically_resolved, strongly_inferred at coper ≥ 0.80 |
Included | Export + dashboard |
bounded / Provisional (coper < 0.80) |
Excluded | Reconciliation report, coverage |
| Stage-C allocated / network-derived splits | Excluded (capped below the floor) | Shown as shared cost |
unknown / not_identifiable |
Excluded | Unknown Spend Analyzer |
| Disputed | Excluded while open | Dispute surface |
Unknown, provisional, and disputed values remain visible in reconciliation reports so finance can always see exactly what was excluded and why: nothing is hidden, and nothing below the floor is ever silently billed.
The billing basis¶
Your commercial agreement is measured on the same numbers you see in the app. Billing visibility lives in the admin console’s billing card; billing mutation is admin-only and fails closed.
- The billable base is reconciled-actual monitored spend at
coper ≥ 0.80, the one canonical floor, measured against a frozen, usage-normalized counterfactual. - Savings-share applies only to verified, realized savings below that frozen baseline. Organic growth is never billed as savings.
- The non-double-charge invariant guarantees spend overage and savings-share never bill the same dollar.
- Quarterly true-up reconciles actual monitored spend against the included band.
See administration › admin console for billing visibility and optimization & adoption for how verified savings are established.
Next steps¶
- Use Coverage & unknowns to maximize chargeback-ready coverage before you export.
- Use Attribution detail to defend any line an owner disputes.
- Use Reporting & exports to see the full export and reporting capability.
- Use Audit logs to trace every export, approval, and policy change.