Tarmac / Why Tarmac
Category-forming · the first mover owns the narrative

Observability sees. Gateways throttle. Only Tarmac enforces — and produces books finance can sign.

Adjacent tools exist, and major platforms are bolting on cost features. But none of them prevent a breach before spend, none rebalance a fleet by business priority, and none produce a finance-grade set of books. The gap isn't a feature — it's an architectural posture.

// 01 · The gap, at a glance

Five categories. Same three gaps run through all of them.

No one is wrong; everyone is partial. Gateways were built for developers. FinOps was built for cloud cost. Observability was built for traces. Routers were built for per-call quality. Platform-bundled features were built for vendor lock-in. None of them were built to be the financial system of record for an autonomous fleet.

Category
Pre-spend hard cap
Priority-aware rebalance
Finance-grade books
AI gatewaysPortkey · LiteLLM · Kong AI · Cloudflare · TrueFoundry
throttle & alert
per-key quotas
developer-grade
FinOps / cloud-costCloudZero · Vantage · Finout · Apptio
retrospective
not in path
allocation only
AI observabilityHelicone · Langfuse · Datadog LLM
traces, not control
monitoring
not source of record
Model routersMartian · Not Diamond · OpenRouter · Unify
per-request only
per-request only
no ledger
Platform-bundledDatabricks Unity AI · hyperscaler cost
single-platform
shallow
locked-in
Tarmac// the financial control plane
atomic authorization holds
by business priority
one reconciled ledger
// 02 · Category by category

Where each tool stops, and where Tarmac picks up.

// 01

AI gateways

Portkey · LiteLLM · Kong AI Gateway · Cloudflare AI · TrueFoundry
// What they do well

They sit in path. They observe and rate-limit.

Gateways have already won the request-path real estate at most teams. They tag, log, retry, route, and apply spend-capped keys. For developer-grade observability and basic per-key quotas, they are good enough.

The gap. Throttle ≠ enforce. A spend-capped key throttles when a counter exceeds a value — it has no atomic hold and no concept of a per-run, priority-aware budget. By the time a quota fires, real spend may already have leaked.
// Where Tarmac picks up

Authorization-hold ledger. Priority-aware fleet rebalance. Finance-grade books.

We integrate with gateways where it makes sense — point Portkey at Tarmac, or run Tarmac alongside Kong, and keep their tracing while we own the cap. The CFO relationship is ours.

Net. Gateways are great partners. They are not the financial system of record an agent fleet needs, and they were never built to be one.
// 02

FinOps & cloud-cost

CloudZero · Vantage · Finout · Apptio Cloudability
// What they do well

Visibility, allocation, and forecasting on yesterday's spend.

FinOps platforms have built a decade of muscle on the cloud bill: tag, allocate, forecast, chargeback. The new "FinOps for AI" tier extends the same model to LLM spend — read CSP and provider bills, allocate, report.

The gap. Retrospective. The FinOps platform is not in the execution path; it reads the bill after the spend has happened. It can tell you why you blew the budget. It cannot stop you.
// Where Tarmac picks up

Tarmac is the spend layer that lives in front of the bill.

FinOps tools are great post-hoc. Tarmac is the pre-hoc. The two are complements: many of our customers feed Tarmac receipts into CloudZero or Vantage for cross-line-item allocation. Tarmac is the only one that prevents the line item from becoming a problem in the first place.

Net. FinOps reports. Tarmac controls. Both go in your stack.
// 03

AI observability

Helicone · Langfuse · Datadog LLM Observability · Arize · Honeycomb
// What they do well

Traces, evals, prompts, latency.

Observability tools are how engineers ship agents that work. They trace each run, attach evals, surface regressions. For debugging an agent's behaviour, they are essential.

The gap. They monitor; they don't control. An observability platform sees that a research agent burned $4,200 in an hour — after the fact. It does not have an opinion about whether that run should have been admitted.
// Where Tarmac picks up

The control layer that decides which runs happen.

Tarmac and an observability tool are read/write halves of the same picture. You ship every authorization to your observability stack from Tarmac's webhook stream; we don't try to replace tracing or evals. We own the decision.

Net. Observability watches. Tarmac decides. Run both — and ship every Tarmac receipt to your trace stack.
// 04

Model routers

Martian · Not Diamond · OpenRouter · Unify
// What they do well

Pick the best model for one request.

Routers optimize a single call — they ask "given this prompt, which model gets the best quality-per-dollar?" and forward it. Useful for teams who care about per-request unit economics on commodity work.

The gap. The router doesn't know your monthly cap, your agent's priority, or your fleet's pace. It optimizes a request; it does not enforce a budget. There is no ledger, and there is no concept of a "run" with a hold lifecycle.
// Where Tarmac picks up

Tarmac is the budget-aware decision layer above the router.

A router can be Tarmac's lane — we pin the family, the router resolves the specific model, Tarmac controls the tier. We are happy to sit on top of one or to replace one for teams who don't need that flexibility.

Net. Routers pick. Tarmac authorizes. Compose them.
// 05

Platform-bundled

Databricks Unity AI Gateway · AWS Bedrock cost · Azure AI Studio · Google Vertex
// What they do well

Cost guardrails for the platform you're already on.

Hyperscalers and big-tent platforms are bundling cost controls into their stacks. If you live entirely inside Bedrock, or entirely inside Vertex, the built-in budget feature is the path of least resistance.

The gap. Lock-in and depth. Almost no agent fleet lives on a single provider; the moment you span Anthropic + OpenAI + your own GPUs, the bundled control plane stops working. And depth — priority-aware rebalance, finance-grade books — is not the priority for a platform that views cost governance as a feature, not a product.
// Where Tarmac picks up

Neutral. Cross-platform. Built only for this.

Tarmac's value compounds with provider diversity. A bundled control plane has every reason to keep you on one provider; Tarmac has every reason to let you span the best of each. Customers tell us this is the single biggest reason they buy.

Net. Bundled features are shallow and single-platform. Tarmac is deep and cross-platform.
"You can't enforce a budget you can read. You enforce a budget you sit in front of."
// Jed · founder · Tarmac
// 03 · Architectural difference

The reason no one else prevents a breach. You can't bolt enforcement onto a tool that watches the bill.

Every gap above traces to a single architectural choice: prevention requires sitting in the request path with an atomic hold against the live budget, and producing an append-only ledger that becomes the source of truth for both engineering and finance. Tools designed for other purposes can't be retrofitted into that posture without rewriting their core.

// Adjacent tools

Built to observe.
Bolt-on cost controls.

The control surface is downstream of the spend. The "cap" is a counter that fires an alert when it's already too late. The dataset is a copy of the provider's bill — interpreted, allocated, reconciled by hand.

  • Out-of-path or only in some paths
  • Counter-based limits · no atomic hold
  • Throttle & alert after the fact
  • No priority concept across the fleet
  • Books reconciled to the provider invoice
  • Single-platform or developer-grade
// Tarmac

Built to enforce.
Ledger as source of truth.

The control surface is upstream of the spend. The cap is enforced by an atomic hold in the same transaction that authorizes the run. The dataset is the authoritative ledger — the provider invoice reconciles to it, not the other way around.

  • Proxy in every request path
  • Atomic, transactional authorization holds
  • Prevent · throttle · admit — before forwarding
  • Priority-aware fleet-wide rebalance
  • Append-only, externally verifiable ledger
  • Cross-platform, neutral, finance-grade
// 04 · Buy-vs-build

The honest math on building this in-house. It is a multi-quarter, correctness-critical, compliance-laden product.

Customers ask. We're happy to walk you through the analysis. It's not the engineering hours — it's the design partner pressure, the on-call burden, and the compliance work that engineering teams routinely under-estimate.

Line item
Build in-house · Year 1
Tarmac · annual cost
2 senior infra engineersfully-loaded · 12 months
$420K
PM & design partner ops0.5 FTE
$110K
SOC 2 Type II programvCISO · GRC platform · pen test
$95K
included
On-call rotation24/7 page · 6 engineer-months allocated
$140K
included
Tarmac governance fee3% on $1.5M governed
$45K
Tarmac performance fee1% on ~$300K realized savings
$3K
Year-1 total cost of ownership
$765K
$48K
Time to first authorization. Tarmac · 1 afternoon  ·  In-house · 2 quarters minimum · Ongoing. The CI release gate, the concurrency-invariant test, the audit trail, the GL exports — every one is a multi-month project on its own.
// 05 · Why now

Three forces. The category forms in the next 18 months — or it doesn't form at all.

Inference is becoming the dominant cost of AI. Agents are going into production fast. And the spend is getting out of hand at a rate no adjacent vendor is moving to govern. "FinOps for AI" has emerged as a named discipline precisely because the pain is now industry-wide. The first mover to own the enforcement-plus-finance combination can own the category narrative.

// The choice

Watch the bill, or own the cap.

If you already have observability, FinOps, and a gateway — keep them. Add Tarmac as the layer between the agent and the spend, and the layer between the spend and the books.

// The wedge in one sentence

Tarmac is the only layer that enforces a hard cap before spend, rebalances a fleet by priority, and produces books engineering and finance both trust.

  • Prevention, not detection
  • Priority-aware rebalance, not per-key throttle
  • One ledger, not two reconciled reports
  • Neutral & cross-platform, not single-vendor
  • Built for the CFO, not the developer