ACPpotamia

Advanced guide / Chapter 5 of 7

Governance and compliance.

Once several departments run agents, security and finance want one place to set the rules and one place to see what happened. In ACPpotamia, an organization groups your teams, and model policies control which models they can call. The audit log and its export are your evidence afterwards.

Organizations: one policy, kill switch and export over several teamsOrganizationmodel policy for every teamkill switch for every teamcombined spend · one export · rolesTeam: Supportown keys, limits, billingagents: support-bot, triagetenants: noneTeam: Researchown keys, limits, billingagents: research-agentmodel rule: claude-* onlyTeam: Productown keys, limits, billingtenants: your customersper-customer budgetsRules flow down. Teams can narrow them, never widen them.
The organization sets rules for every team. Each team keeps its own keys, limits and billing, and can tighten the rules but never loosen them.

Model access policies

A policy is one of three kinds: "all models", "only these models" or "all except these". In patterns, * matches anything.

GoalRulePatterns
Only approved vendorsOnly these modelsclaude-*, gpt-5*
No premium models in this teamAll except these*opus*, *fable*, gpt-5-pro*
A CI key uses only small modelsKey: only these*-mini, claude-haiku-*

Organization, team and key rules all apply at once. A call that breaks any of them gets HTTP 403 model_not_allowed and never reaches the provider. The error names the rule that refused it, so nobody has to guess.

Organizations and roles

RoleCan
ViewerSee every team's spend, calls and the organization log.
AdminAlso: stop and revive all teams, set the organization model policy, export, create teams, and join any team as admin (logged).
OwnerAlso: add and remove people and set their roles.

Audit trail and export

Audit pipeline: every call is recorded, then exported as CSV, JSONL or raw archivesEvery callallowed or blockedTeam queueinside the controlobject, durableD1 recordssearchable, 365 daysActivity in the consoleR2 daily archive.jsonl.gz per day+ request/response text*Console exportCSV or JSONL, filtersraw archive downloadExport API → your SIEMGET /v1/controlplane/audit/exportwritten every 5 seconds* request and response text only when the team turns on payload logging (Pro and Enterprise). Provider keys are never stored.
Each call is queued safely inside your team's control object, then written to the database and to a daily archive. Exports read from those.
FormatBest forRange per file
CSVSpreadsheets and finance366 days
JSONLData tools, one record per line366 days
Raw daily archive (.jsonl.gz)Compliance archives; includes request and response text when payload logging is on31 days

Pull exports from your own pipeline

# Nightly job: yesterday's calls into your SIEM or data lake
curl -s "https://acp.examopotamia.com/v1/controlplane/audit/export?format=jsonl&from=$(date -u -d yesterday +%F)&to=$(date -u -d yesterday +%F)" \
  -H "Authorization: Bearer $ACP_ADMIN_KEY" \
  | your-siem-ingest --source acppotamia

Retention and privacy

← 4. Per-customer budgets (SaaS) 6. Testing and CI →