QuantZK Control: AI Spend Firewall

QuantZK Control puts hard, cross-provider financial controls on AI agents before they spend money, and reconciles every charge afterward.

Cloud IAM controls what machines can access. QuantZK controls what machines can spend.

Unlike provider-native budgets, QuantZK applies the same economic policy across vendors and keeps reconciliation (and optional portable evidence) independent of the vendor being charged.

What you get

• Credential-isolated gateway in the request path for protected traffic
• Workload identities and per-agent / cost-center budgets
• Per-request hard caps, vendor and model allowlists
• Real-time ALLOW / DENY with atomic budget reservations
• Cross-provider spend aggregation
• Reconciliation across AUTHORIZED / EXPECTED / OBSERVED / BILLED
• Discrepancy queue and Spend Operations dashboard (/spend)
• Optional portable receipts (QZR / VDI) for disputes and audits

Charge Authority, QZR, and VDI are protocol capabilities behind Control. They are not separate SKUs customers buy first.

Why teams add QuantZK

OpenAI and Anthropic already ship org/project spend controls inside their own ecosystems. Teams that already run an AI gateway (for routing, keys, or observability) still need a financial control plane when:

1. One budget must span providers — a research department budget applies whether traffic hits OpenAI, Anthropic, or another API.
2. Denial must happen before the provider call — loops, expensive recursion, and unauthorized models are blocked on the protected path with credentials isolated on the gateway.
3. Billing must be reconciled after execution — AUTHORIZED, EXPECTED, OBSERVED, and BILLED are matched so OVER_BILLED, duplicates, usage mismatch, unauthorized usage, and EXECUTION_UNKNOWN stay visible.
4. Disputes need portable evidence — optional independently verifiable receipts when another party must check a charge.

Cross-provider budgets and pre-call denial establish relevance. Reconciliation against actual provider billing, careful handling of unknown executions, and dispute-ready evidence are the results that justify adding QuantZK beside an existing gateway.

Outcomes

1. Stop runaway agents before money leaves — DENY before the provider call; credentials never on the agent.
2. One spending policy across competing providers — same workload budget across vendors.
3. Find money that should not have been charged — OVER_BILLED, DUPLICATE, USAGE_MISMATCH, UNAUTHORIZED, EXECUTION_UNKNOWN.
4. Evidence when something goes wrong — reconstruct who requested it, which policy applied, what was authorized, observed, and billed.

Who buys

Primary: Head of AI Platform / Head of AI Infrastructure.
Secondary: FinOps / Cloud Cost. Security often champions credential isolation.

Typical ICP: multi-provider production agents, meaningful usage-based spend, a central platform team, and enough automated spend that mistakes matter (often $100k–$1M+/month across LLM and API workloads).

Pilot package

Paid Control pilots are scoped on /control/pilot: typically $5k–$15k, 30–60 days, one business unit, one or two providers, a protected gateway deployment, reconciliation, and a weekly Protected Value report.

Pilot success criteria (acceptance targets until measured results support broader claims) include gated protected requests, zero budget oversubscription on the protected path, denied requests producing zero upstream calls, and a defined reconciliation coverage against provider billing records.

Try it

cd protocol && npm run demo:ai-spend-firewall

Walk the operations surface at /spend. Protocol receipts and offline verification live under Protocol & evidence.

See also: design-partner-pilot.md and machine-spend-control-plane.md.