Internal tools and employee AI
Every office used to have the printer with no codes on it. One machine, one account, one bill, and once a quarter somebody in finance would hold up an invoice for 40,000 pages and ask who did this. Nobody knew. Nobody could know. The information had never been recorded, and there was no clever query that could recover it afterwards.
You are now rolling out a docs assistant for support, a code-review helper for engineering and a contract-draft tool for legal, all through one provider key. Finance wants per-team budgets. Security wants every prompt logged. You are about to build the printer.
Attribution has to happen at call time
A provider invoice is one number for one key. It is a sum, and a sum cannot be un-added. The identity of whoever made each call was never part of the request, so it is not sitting in a log somewhere waiting to be joined. Teams try anyway: timestamps correlated against app logs, heuristics on prompt shape, a spreadsheet somebody maintains by hand. It works until two tools share a key, which is week three.
The fix is unglamorous. Stamp the request while you still have the context, then every report downstream is a group-by rather than an investigation. Ringside takes two headers for this. FC-Customer carries the team or cost center, which is also what the budget hangs off. FC-Tag carries the finer detail as a comma-joined value, up to twenty tags per call, so the employee id and the source app both travel with the request. Ask /v1/usage?group_by=tag afterwards and the answer to who spent $4,000 last Tuesday is a query, not a meeting.
Who asks for what
Finance wants the spend to stop at the number they approved. One Customer per team with monthly_budget_usd set gives them that, enforced on the request path, so an over-budget team gets a 402 rather than a nasty line item next quarter. Put the cost center in metadata and the rollup lands in the shape their ledger already uses.
Security wants the record somewhere they control. Register a webhook once and run lifecycle, budget and moderation events are signed and delivered into Splunk, Datadog or whatever the audit store is. Retries are handled, so a SIEM restart does not create a hole in the record.
IT wants one credential. Teams are Customers, not separate provider accounts, so there is a single key to rotate and no per-team secret sprawl to clean up when somebody leaves.
Architecture
In code
# One Customer per internal team, with a hard monthly cap.
team_customer = httpx.post(
"https://api.fightclub.pro/v1/customers",
headers={"Authorization": f"Bearer {RINGSIDE_KEY}"},
json={
"external_id": f"team_{team.slug}",
"display_name": f"{team.name} (internal)",
"monthly_budget_usd": team.monthly_ai_budget,
"metadata": {"cost_center": team.cost_center},
},
).json()
# Employees hit your internal app, which forwards to Ringside.
# FC-Tag takes a comma-joined value, up to 20 tags per call.
resp = client.chat.completions.create(
model="fc:anthropic/claude-sonnet-4.6",
messages=messages,
extra_headers={
"FC-Customer": team_customer["id"],
"FC-Tag": f"employee:{user.id},app:{request.source_app}",
},
)
# Register a webhook once; every AI call streams an audit event to SIEM.
httpx.post(
"https://api.fightclub.pro/v1/webhooks",
headers={"Authorization": f"Bearer {RINGSIDE_KEY}"},
json={
"url": "https://siem.corp.internal/ringside-audit",
"events": ["run.completed", "run.failed",
"customer.budget_exceeded", "moderation.flagged"],
},
)
# Later, the question everyone actually asks:
# GET /v1/usage?group_by=tag&from=2026-04-01&to=2026-04-30