Risk Tier, Data Path and Approvals Settled Before the First Build

Settle three things before the first build: the EU AI Act risk tier, the path company data takes, and which role approves which action. Each one becomes an entry the control centre reads back from the running systems.

Ship that control centre alongside the first integration, behind a directory sign-in on the company’s own site, so the person answering for the rollout reads the position from a link. Give the review of each piece of work to whoever owns it.

A Fixed Monthly Bill, Attributed Feature by Feature

Run the infrastructure at a fixed monthly server price. Both versions of an app share one machine and the databases share one box, so a test environment adds nothing to the line.

Attribute the AI spend per feature: the model in use is a registry entry that swaps without a rebuild, every call is logged with its token cost, and a live readout shows what a single job is accumulating while it runs. The billing view reconciles against the time ledger, so declared and derived hours agree.

Every Figure Read Off an Artifact, Disagreements Listed

Read every name, database, hour and euro off an artifact that already exists, and record in a provenance document which artifact each data file came from. A field with no source is left out, with its empty state designed.

Because two sources can then be compared, publish the drift list: a manifest that no longer matches the box, a DNS entry aimed at a server that was given up, a runbook filed as unexecuted while the zone files show it done. Credentials appear as a name and a location, and trading figures stay out.

Day one
governance and cost tracking ship with the first integration
6 views
routed and deep-linkable, from is it up to what it cost
Fixed monthly
EU server price standing in for a metered bill
Per feature
an approved model pinned, and every call cost-logged

Shipping the First Integration Governed, With the Cost Visible

Settle the Position Before the Build 3 steps
01

The Risk Tier Is Settled Before Any Seat Is Bought

Settle the EU AI Act risk tier, the data path and the places personal data is touched in the discovery pass, before seats are bought or a tool is picked. Enter each of them into the control centre, which reads the position back from what is actually running.
02

Who May Decide What, Written Down First

Write the approval map before the first build: which role may approve which action, which data may reach which service, and what an agent is kept out of. Hand the onboarding material to the staff who use the tools, so the rules sit with the work.
03

Human Gates Where the Business Risk Sits

Put a gate on each action that changes a live record. A monthly scheduling run reads the office worklist, matches buildings and proposes technician routes; a person reviews before anything is written, and every run keeps a history entry. For a record created from a chat, the model prepares the fields and a person submits them.
A Control Centre of Their Own 3 steps
04

Six Questions a Customer Asks, Six Routed Views

Build one routed view per standing question: what is running and is it up, which machines it sits on, how it fits together, whether it is proven to work, how each part is configured with Preview against Live, and what was paid for. Each view deep-links to a single slot.
05

Sign-In Against the Directory the Company Already Governs

Sign in through MSAL against Microsoft Entra, so access follows the existing directory and is withdrawn there when someone leaves. Build the portal as a reader with no backend of its own, which keeps it able to run on customer hardware. Both instances sit on our own servers today, so portability is true and unproven.
06

One Image, Any Slot, Configuration Injected at Start

Build one container image and inject the runtime configuration at start, so the same image runs in any slot. Ship it the same way as the rest: GitHub Actions to a container registry, then SSH to the box behind the shared Caddy edge, with the deployed digest checked after the release.
Fixed Monthly Cost, Attributed Per Feature 2 steps
07

A Fixed Monthly Server Price in EU Data Centres

Move the infrastructure to a fixed monthly server price in German and Finnish data centres. Run both versions of an app on one machine and the databases on one box, so a test environment adds no line. Read the figure shown on the dashboard from the running systems.
08

Token Cost Attributable to the Feature That Spent It

Ship each AI feature with a model registry entry, so an approved model is pinned per use case and swapped without a rebuild. Log one structured line per pipeline stage with its token, image and video cost, and stream a running cost readout to the screen while the job is going.
Every Figure Read Off an Artifact 2 steps
09

Rule Zero: Every Figure Transcribed From an Artifact

Read every port, image tag, domain, database, hour and euro off an artifact that already exists, labels included. Where a source is missing, leave the field out and design its empty state, and record in a provenance document which artifact each data file came from.
10

Preview and Live Compared Setting by Setting

Compare every setting per component across Preview and Live, and classify each difference as intended design or as drift. Publish the list as its own section, so an intended difference is on the record and a divergence is found before it changes how something behaves.

Frequently Asked Questions

What does this actually cost to run every month?
A fixed monthly server price rather than a consumption bill, plus the AI spend of the features switched on. Each feature pins an approved model per use case, every call is logged with its token cost, and the dashboard reads both figures from the running systems, readable by anyone with access on any day of the month.
Where does the data physically sit, and who can reach it?
In German and Finnish data centres, as containers on servers we operate, with no US-hosted control plane in the runtime path. Reach is scoped at the database login, so one tenant's credentials open only that tenant's databases, and server administration can be handed to the customer. The AI model provider is decided explicitly in the compliance pass.
Do we only get the dashboard once the pilot has proven itself?
It ships with the first integration. The control centre is a reader with no backend of its own, signs in against your existing Microsoft Entra directory, and runs as one container image in any slot, which is what keeps day-one delivery cheap.
How do we know the dashboard is telling us the truth?
Every figure is read off an artifact that already exists, and a provenance document names the artifact behind each data file, including which source was missing for the three of five that shipped empty on one build. The drift list is the check: it reports where your manifest and your DNS disagree.