PRODUCT · GOVERNED AI ACCESS

The control plane for governed AI model access.

AIMS sits in front of your OpenAI-compatible gateway, controls who can use which models, issues short-lived scoped keys, and attributes every token and every pound to org, project, feature, and developer.

Book a demo → See it in your tools
Short-lived scoped keys Feature-level spend attribution Gateway-enforced budgets
01Live product surface

Dashboard assembled from this page.

An illustrative view of the AIMS control plane, showing how one request moves through entitlement checks, provider routing, and spend attribution.

02Core capabilities

What the platform gives you.

01

Governed key brokering

Short-lived virtual keys replace long-lived provider keys on developer machines. A leaked key is worth, at worst, a few hours scoped to one project, and it is revocable instantly.

virtual keyTTL 4h
sk-live-••••••••7f2a
scoped · 1 projectrevocable instantly
02

Full spend attribution

Every token is attributed down the chain: organisation → project → feature → developer. The result is 100% of AI spend accounted for, with nothing landing in an opaque bill.

Northwind → Payments → checkout-redesign£4,210
100% attributed
03

Per-project entitlements

Admins choose exactly which models each project may use, enforced at the gateway rather than trusted from the client. Expensive frontier models are a deliberate choice, not a default.

entitlement matrixenforced
project
OOpenAI
AAnthropic
Payments
Onboarding
04

Projects, features & quotas

Projects carry a model allow-list and a monthly budget; features sub-divide spend for attribution. Quotas raise alerts at 80% and 100%, with a two-stage approval workflow for new project budgets.

Payments84% of budget
checkout-redesignrefund-flow
03How it works

From sign-in to attributed spend, in four steps.

1

Sign in with your work identity OIDC

Developers sign in with your existing OIDC identity. No new passwords or personal accounts.

2

AIMS mints a short-lived, scoped key TTL 4h

A scoped virtual key is issued per session for allowed models only. Minting a new key revokes the old one immediately.

3

Requests run through one governed gateway single gateway

Every call goes through one OpenAI-compatible gateway, the only place provider keys are held. Unpermitted models are blocked at source.

4

Spend is tagged and rolled up auto-rollup

Each request is tagged to organisation, project, feature, and developer. Usage and cost roll up automatically by team and feature.

Sign in Mint key Route request Attribute
A management plane in front, an inference gateway behind, so access and attribution are enforced, not asked for.
04Architecture

One request, fully traced.

Watch one request move through governance, gateway routing, and spend attribution.

05The core loop

Provider → entitlement → spend, on repeat.

Each request is entitlement-checked, gateway-routed, tagged to project and feature, and attributed as a readable spend line.

06Request Authorization Flow

How one request gets allowed or denied.

This trace shows identity, entitlement, policy, routing, and attribution decisions in order, before provider spend occurs.

07Attribution

Every token, resolved to a line you can read.

Spend arrives already broken down the way you work, by project and by feature, not as one lump sum. The person signing for the bill can finally answer what it bought.

aims · this month Sorted by: Highest spend ↓resolving
Northwind → Payments → checkout-redesign
£4,210
128.5k tokens · 35% of spend
GPT-5 · 23,400 tokens · £0.18 / request · 14 Aug
Northwind → Payments → refund-flow
£2,680
Claude · 16,840 tokens · £0.12 / request · 14 Aug
Meridian → Onboarding → kyc-checks
£5,940
Gemini · 31,200 tokens · £0.21 / request · 13 Aug
08Why AIMS, not the alternatives

Provider dashboards show spend. AIMS adds governance context.

AIMS enforces identity, policy, and feature context at the gateway, so every cost line is attributable and actionable.

ONE REQUEST · TWO OPERATING MODELS
01 REQUEST RECEIVED The same GPT-5 request enters both operating models.
?
Provider dashboardIdentity-only trace
identity only
REQ_8F21GPT-5received
FINAL RECORD£0.18 · alex@northwindfeature: unknown · project: unknown
AIMS control planeIdentity + policy + feature context
governed context
REQ_8F21GPT-5governed
RESOLVED SPEND£0.18 · Payments · checkout-redesignNorthwind · GPT-5 · budget allowed · 842 tokens
↗ Same request. Different answer.From “who spent it?” to “what it was spent building.”
  • Attribution0% traced100%*
  • Access exposed100%0%
  • Budget enforced£0 / £0£4,210 / £5,000
09Objections, answered

Common questions.

No. AIMS sits in front of your existing OpenAI-compatible gateway. It governs access and attribution without replacing the inference layer you already have.base_url = "https://gateway.aims.dev/v1"
Requests are rejected at the gateway with a clear 403 response. Alerts fire at 80% and 100% via the dashboard. Two-stage approval is required to raise a project's budget.HTTP 403 · budget_exceeded
No raw provider keys are distributed. Developers authenticate via OIDC and receive a short-lived virtual key scoped to their project. The gateway is the only component that ever holds provider credentials.aims key mint --ttl 4h --scope checkout-redesign
Most teams are running governed requests within a day. AIMS is an OpenAI-compatible proxy — change your base URL and add the virtual key header. No SDK required.npm install @aims/gateway
Get started

Governed access. Honest attribution.

Register interest See pricing
✓ SOC 2 Type II✓ Zero data retention✓ 99.99% uptime