One vocabulary from the tap to the database
Three sources on what a record does not show: token use per developer up 18.6 times in a year, two telemetry vocabularies made into one, and an AI tool connected to company data by somebody who does not own the risk.
How we Organise
Token use per developer rose eighteenfold while the price of a token fell
Rav Hayer of Thoughtworks reports that per-token prices have fallen by up to 98 per cent since 2024 while enterprise AI budgets rose from 1.2 million dollars to more than 7 million. Token use for each developer rose 18.6 times in under a year, because the agentic coding tools that do the work call models over and over. He names three markers of a firm that has lost control of it. There is no token budget for each agent, there is nobody who owns what is spent, and the cost is reviewed monthly rather than in real time. One large financial institution brought its governance under a single control plane, and it cut the waste by 40 per cent while it shipped the same features.
His second marker is a requirement we already make of a finance team.
One person is accountable for assembling the team’s full cost, including invoices raised elsewhere in the firm on its behalf.
Hayer reaches that requirement from inside a firm’s own books. The firms he names each miss it somewhere different. Uber spent an annual AI budget in four months after granting engineers broad access to coding agents. Meta ranked engineers by token use and withdrew the leaderboard within days. Those are Thoughtworks describing other firms rather than the firms describing themselves. The institution is not named, the 18.6 figure carries no sample, and the consultancy that prescribes the control plane is the one that sells it.
How we Build
The client and the server had described one journey in two vocabularies
LinkedIn rebuilt its telemetry on OpenTelemetry across iOS, Android, web and its backend services. Aashay Mittal and six colleagues write that the member journey had been told in two languages that never translated. Client analytics described what a member did, server traces described how the systems responded, and connecting the two was manual and slow. Every span now carries the same triple, a pageForestId, a traceId and a spanId. The pageForestId is created as a member enters a page context and held across each request made from it. Where OpenTelemetry’s semantic conventions do not cover client journeys, LinkedIn extends them with governed conventions of its own.
A boundary wants one agreed vocabulary, and we put that plainly.
Every term crossing this boundary resolves to one agreed meaning, with an arbiter and one declared place where translation happens, and the agreed term is the one the published interface carries.
Both of the halves it asks for are in LinkedIn’s account. The one meaning for each term comes from the semantic conventions, and the place where the translation happens is the export stage that adapts the spans to the firm’s own tracking format. Mittal and his co-authors state what it costs to go without that, which is that correlation from end to end degrades into guesswork. They publish no before-and-after figure for the time an investigation takes. This is one firm’s migration, so how far it carries to a smaller organisation is not something the account settles.
How we Assure
In 43 per cent of firms somebody who did not own the risk authorised the AI connection
DNSFilter surveyed 400 IT and security professionals in the United States and Canada in June 2026, at manager level and above in firms of 150 to 5,000 people. Among the firms whose staff use AI at work, 36.8 per cent let an employee grant a new tool OAuth or API access and then tell IT afterwards, and a further 6.5 per cent do not ask to be told at all. Its resolver data puts the gap wider. Across more than 43,000 North American organisations in August, the median resolved five distinct AI vendors in a business day and 15.2 per cent resolved more than ten. Professionals put that last figure at 0.5 per cent.
We ask a firm to write its decision rights down.
Every decision right the firm has written down carries a test and exactly one decider.
That 43 per cent is a decision nobody wrote down, and our test reads the register. Where a firm holds no entry for who may connect a tool to company data, the test finds no population and reads true. Such a firm passes while the decision sits with whoever installed the tool. The survey belongs to a security vendor and suits what it sells, while the resolver figures are measurements rather than opinions and cover one network. If you read that differently, write to transform@dromologue.ai.