01/ TELEMETRY
Continuous MTD spend calculation across multi-cloud environments.
[SYSTEM OPERATIONAL]/Multi-Cloud Circuit Breaker
Cloud & API Budget Circuit Breaker
Automated hard-cap policy enforcement and API key revocation for GCP, AWS, and OpenAI. Prevent runaway billing spikes before they hit your card.
policy.enforcement: enabled·open-source
ccao://telemetry/mtdstreaming
[GCP]project-prod-402MTD: $14.20 / $100.00 | STATUS: OK
[AWS]us-east-1-appMTD: $48.90 / $50.00 | STATUS: NEAR LIMIT
[OAI]org-llm-pipelineMTD: $25.00 / $25.00 | STATUS: BREACH (KEY REVOKED)
last sample: 14:32:08 UTC · refresh interval: 60s
System architecture
Guardrails for expensive infrastructure
Three control layers. One auditable path from spend signal to enforced limit.
02/ CIRCUIT BREAKER
Automated IAM policy attachment and OpenAI key revocation upon threshold breach.
03/ ZERO TRUST
Client-side AES-256-GCM credential encryption. Keys never exposed in plaintext.
Execution path
From spend signal to enforced limit.
01
Connect
Link GCP, AWS, or OpenAI credentials through the control plane.
02
Set the cap
Define a provider-specific budget and choose the enforcement policy.
03
Break the circuit
CCAO revokes or detaches access when the hard limit is breached.
FAQ
Questions, answered
CCAO triggers the safety action you selected for that budget. For GCP, it detaches your billing account to halt paid resources. For OpenAI, it instantly revokes the API key. Everything is recorded in your audit log.
Your keys are encrypted at rest using AES-256 before saving to the database. They are decrypted in memory only when active background workers poll billing APIs.
Deletion wipes everything immediately. Your credentials, budget caps, alert logs, and spending history are permanently deleted from the database.
Background jobs poll billing endpoints on your configured schedule. You can also run manual spend checks from your dashboard whenever you deploy new infrastructure.
CCAO supports GCP, AWS, and OpenAI out of the box. You connect your own API keys or service account credentials in the dashboard.
Ready state