Drop in your Anthropic, OpenAI, Cursor, or Copilot admin key. We never store the raw key — only an AES-GCM envelope that the worker decrypts at ingest time. Within 60 seconds, your first batch of usage events lands in the ledger.
Every usage event becomes one immutable row: tenant, user, vendor, model, tokens, micro-cents, and the exact price_table_id in force at the time. Idempotency keys deduplicate webhook retries. A daily reconciliation worker compares ledger sums against the per-budget Durable Object counter and flags any drift over $0.01.
An allocation policy is a row: role_filter, level_filter, region_filter, formula_json, cap_cents, period, rollover. Want 50% of base salary, capped at $3,000/quarter, rolling over for L5+ in EU? One row.
Connect GitHub, Linear, or Jira and we join your outcomes table to ledger events. A high-spend engineer who also ships 12 PRs/week is a legitimate user. One who ships 0.5 is a flag for the scoring board.
Vendors reprice quarterly. We version every price into D1 with effective_at and expires_at. Every ledger row records which price was used, so historical cost recomputes are exact, not approximate.