Almost 20 years ago, in the early years of cloud computing, the handful of us analysts who covered the space started talking about “single panes of glass.” The idea being that in a world typified by multiple platforms, infrastructure approaches and environments, having a single dashboard and control panel would give visibility and governance to users.
That conversation was interesting and there were early vendors who set themselves up to conquer this space. The Clouderati will be well aware I’m talking about George Reese and his team at enStratus, who built exactly this kind of multi-cloud management layer before the term multi-cloud was even fashionable. George was smart, the technology was solid, and the problem was real. The market, as markets sometimes do, took a decade and a half to fully catch up with the vision.
Fast forward to today and I’ve been having some fascinating conversations about a remarkably similar challenge when it comes to AI governance. The same fundamental blind spots, the same early vendors positioning themselves to be the control plane that brings order to chaos. Except this time the stakes are considerably higher. In the cloud era, poor governance meant some virtual machines running in the wrong region and a CFO asking uncomfortable questions about the AWS bill. With AI, the uncomfortable questions arrive faster, cost more to answer, and occasionally end up in the newspaper.
The Token Bill That Nobody Budgeted For
Let’s start with the money, because the money is genuinely extraordinary and the stories coming out of organisations right now range from eye-watering to almost comedic.
AI systems are billed on tokens, a measure of the text going in and coming out of a model. This sounds innocuous until you do the arithmetic at organisational scale. Different models carry wildly different price points, and the gap between a capable but economical model and a frontier reasoning model can be an order of magnitude or more in cost per query. This matters enormously when you’re running thousands of queries a day. It matters even more when nobody has actually thought about which model should be used for which task.
What happens in practice is that users default to the most capable model available because it produces the best results, and because nobody has told them otherwise, and because the cost is invisible at the point of use. You end up with people running frontier AI models to write two-line emails, summarise documents that a cheaper model could handle competently, or, and this is a real phenomenon, get restaurant recommendations. It’s the enterprise software equivalent of hiring a neurosurgeon to put up a shelf. Technically capable, catastrophically overspecified, and someone is paying for it.
The developer context is more acute still. Coding agents like Claude Code have become genuinely transformative tools, and the productivity gains are real enough that adoption has been rapid and enthusiastic. The problem is that coding agents are extraordinarily token-hungry. They read files, write code, run tests, read error output, iterate, and generate extended reasoning chains before producing anything useful. There have been cases, not apocryphal, of individual developers burning through their entire organisation’s monthly AI budget in a week. Without any malicious intent whatsoever. Just enthusiasm and a gnarly codebase. Uber’s CTO noted publicly that the company exhausted its entire AI budget for 2026 within just a few months of the year starting. That is not a rounding error. That is a governance failure.
FinOpsX and the Birth of Tokenomics
I was at FinOpsX in San Diego recently, and the mood in the room told you everything you needed to know about where enterprise AI spend has arrived as a problem. FinOpsX has historically been the gathering place for the people who care deeply about cloud cost management, a community that is, by professional disposition, extremely serious about financial visibility and extremely suspicious of uncontrolled variable spend. Watching that community grapple with AI costs in real time was instructive.
When a Goldman Sachs chart goes up on the main stage projecting usage of 120 quadrillion tokens over the next three years from a current base of around 6 quadrillion, you feel it differently than reading about it. The room went fairly quiet.
The headline announcement from the conference reflected the scale of the problem. The Linux Foundation and FinOps Foundation announced the intent to form the Tokenomics Foundation, a new body to unite token users and suppliers around open best practices and standards for AI billing. The supporting cast was not short of ambition: early supporting organisations include Oracle, Google, Microsoft, Accenture, Booking.com, Flexera, IBM, JPMorganChase, KPMG, Salesforce, SAP, and ServiceNow.
J.R. Storment, Executive Director of the FinOps Foundation, was direct from the main stage: token costs and efficiency have become a CEO-level concern, not an engineering footnote. The FinOps Foundation has updated its own mission from managing the value of cloud to managing the value of technology, a deliberate broadening to include AI as a first-class scope, and FinOpsX itself will evolve into a broader Tokenomicon conference from 2027. When a foundation renames its flagship event, it’s not making a branding decision. It’s acknowledging a fundamental shift in what the discipline is actually about.
Ramp reports average monthly enterprise AI token spend increased 13-fold since January 2025, which is a realised number rather than a projection. The cost decline narrative, which has been used to reassure CFOs that AI bills will eventually moderate, has a significant flaw: per-token prices have dropped roughly 98 percent since 2020, and yet enterprise AI bills are rising. Workload volume is multiplying faster than unit costs decline. Anyone who lived through the early years of cloud computing will recognise this pattern immediately.
The Market Has Noticed
The venture capital community, which has a talent for identifying where enterprise pain meets opportunity, has noticed all of this with considerable enthusiasm.
OpenRouter, an AI gateway startup that provides access to over 400 models and claims to be processing around 100 trillion tokens per month, recently raised a $113 million Series B led by CapitalG, valuing the company at $1.3 billion, more than double its valuation from just a year prior. OpenRouter’s pitch is straightforward: help enterprises select different models for different jobs to control costs or increase accuracy for the task at hand. Model routing, in other words. CEO Alex Atallah puts it plainly: the era of picking a single model is over.
OpenRouter is far from alone. Portkey (recently acquired by Palo Alto Networks to be embedded into their AI security platform, which tells you something about how seriously the security industry is taking this) and Helicone sit in the AI gateway and observability space, giving organisations visibility into what models are being called, at what cost, and with what results. LangSmith focuses on tracing and monitoring AI application behaviour. Humanloop is building evaluation and prompt management tooling for teams that need to know whether their AI systems are still performing as intended. Patronus AI and Confident AI are focused on AI evaluation and testing. Arthur AI has been at the enterprise end of model monitoring for several years, which in AI terms practically makes them a heritage institution. And on the security side, vendors like Lakera and Prompt Security are building tooling specifically around prompt injection, data leakage detection, and policy enforcement for AI interfaces.
The success of these companies reflects something important: organisations have no intention of getting locked into a single model vendor. The multi-model future is already here. And with multiple models comes the need for a layer that sits above them all, which is, again, the single pane of glass conversation we were having about cloud two decades ago.
The Security Problem Everyone Is Quietly Ignoring
The cybersecurity dimension compounds the cost problem significantly and is receiving considerably less attention than it deserves.
When employees interact with AI systems, they frequently do so by pasting in context to help the model understand the question. That context can include customer data, internal financial information, proprietary code, strategic documents, and any number of things that the security team would have strong opinions about if they knew it was happening. The problem is that in many organisations, they don’t know. AI interaction frequently happens outside the visibility of conventional data loss prevention tools, in browser interfaces and desktop applications that aren’t instrumented in the same way as traditional enterprise software.
Shadow AI compounds this further. Employees using consumer AI tools on work tasks with personal accounts sit entirely outside enterprise data agreements and visibility. Most security teams would be surprised by the volume of this if they had the monitoring capability to measure it, which many currently don’t.
Beyond data leakage, there are broader governance questions that are only beginning to surface seriously. Which AI systems have been formally approved for use? Which data classifications can be shared with which models? Who is accountable when an AI-assisted decision turns out to be wrong? What is the audit trail for AI interactions that influenced consequential outcomes? These are questions that legal and compliance functions are starting to ask, and the honest answer in most organisations is that the infrastructure to answer them simply doesn’t yet exist.
The Governance Gap
All of which points to the same underlying problem. AI adoption has moved considerably faster than AI governance, and the gap is widening rather than narrowing.
The organisations navigating this well share a few characteristics. They have a clear inventory of what AI is actually running in their environment and what decisions it is touching. They have explicit policies about model selection, which is to say they have thought carefully about which tasks warrant which models rather than letting everyone default to the most powerful option available. They treat model behaviour as something requiring active ongoing monitoring rather than a deployment-and-forget proposition. And they have had honest leadership conversations about risk appetite that address not just the upside of AI adoption but the specific ways it can go quietly and expensively wrong.
None of this is glamorous work. It doesn’t generate the slides that impress at industry conferences. But it is the work that separates the organisations that deploy AI well from those that eventually have to explain a significant failure to a room full of people who wish they were somewhere else.
George Reese and the enStratus team were right about the need for a management layer in cloud computing. The market just took a while to agree. The AI governance equivalent is following a similar arc, with one important difference. In the cloud era, the cost of poor governance was mostly financial and mostly recoverable. In AI, the costs can include data breaches, consequential decisions made at scale without appropriate oversight, and a security posture that has developed significant gaps while everyone was focused on the exciting parts.
The single pane of glass conversation is back. It would be worth having it before the incident, rather than after.
(Another) brilliant analysis taking a hard look at the duality of whatever shiny, civilisation-changing product is currently fashionable in The Valley and beyond. Thank you for taking AI with a grain of NaCl.
As battle-scarred veteran of religious wars over the One Truth in programming languages, operating systems, user interfaces, hardware architectures, network topologies, application distribution, I am OVER all the hype. If technology requires an elite priesthood to operate, product flaws are perpetually just one release or generation away, and consumers need to choose whether to pay their mobile plan payment or the mortgage, the industry has failed. Good accounting and project management practices and unblinking looks at identifiable costs versus benefits should govern adoption of any new technology. Ask for, and look at, the numbers; no matter how much the industry press tells you about what the cool kids are doing.