Visibility

The Command Center

Sign-in opens the Command Center: a board of the organization’s AI spend and activity, with lenses for flow, map, breakdown, models and shape, and a command palette that opens any person, agent, decision, gateway, rule or receipt by name or number. Spend has its own lenses: attribution to teams, applications and people; outcomes; sources; budgets; forecast; workload economics; waste; and optimization.

Coverage answers one question: of the AI money you answer for, what share can ARC1 see? Provider bills are the denominator. Gateway-measured and agent-reported dollars are second readings, compared with the bills and never added to them. An unknown is drawn as unknown, never as zero, and a monthly invoice is never spread across days it did not itemize.

A board for each role LAB

The next console shell gives six roles a board of their own: the CIO or CTO, the platform administrator, security and data protection, finance, the team manager and internal audit. Each board opens on one insight, stated as a change with its basis and freshness, why it happened and what to do next, before any chart.

Any AI, anywhere LAB

AI reaches a company by four paths: copilots inside SaaS applications, API and agent gateways, coding agents on laptops and in CI, and the browser, including unsanctioned use. The AI paths view shows, for each path, what sees it, what governs it and which receipt or record proves it, and stands each one as governed, observed or unseen. Money stays in its own basis on each path and is never added across paths.

Discovery feeds that view from metadata a company already has: identity sign-ins, network and proxy logs, cloud AI inventories, audit logs and provider usage. Findings, such as an ownerless key or an unenrolled device reaching a model host, are ranked for review; identifiers are salted; and an absence of evidence resolves nothing. An application risk catalog rates 164 AI applications from their vendors’ own published terms, read on 21 October 2026, and an attribute not yet read stays unrated.

Defend LAB

Defend is the security team’s space: detections, incidents, assets, exposure and response. Signals about one subject within an hour form one incident. Time to resolve is measured. Time to detect is drawn as unavailable, because no reader yet records detection apart from onset.

Digests LAB

Executives, budget holders and platform owners can receive a daily or weekly email that opens on one insight and carries up to five figures, each marked with its basis. Figures cover the organization and its teams, never a person or a machine. Each digest goes out at most once per slot and never twice to the same person.

SIEM and OpenTelemetry

Findings can stream to Splunk, Microsoft Sentinel, Google Security Operations and Datadog as OCSF 1.3.0 Detection Finding records, in signed batches, delivered at least once. That stream is in our lab and has not yet sent to a live vendor. Separately, the released product can send one reviewed metadata export to Splunk, Sentinel or Datadog once a second person approves it; that delivery is contract-tested.

ARC1 ingests OpenTelemetry traces and metrics over OTLP/HTTP with JSON payloads. On 14 October 2026, the OpenTelemetry Collector Contrib 0.137.0 delivered synthetic traces and metrics into a local ARC1, and none of the canary content reached any table. Protobuf payloads and logs are not supported, and token counts from telemetry are never treated as a bill.

Where it stands

LIVE: in the released product and running on our hosted production deployment, with synthetic data. LAB: built or being built, and run only in our lab or against a vendor’s documented interface. NEXT: designed, not yet built. How we use these words.