Reported, or observed?

Write that a team on personal Claude subscriptions is flying blind on cost, and that the numbers are sitting unread on the laptop, and somebody will ask the obvious follow-up: how do you know the laptop is telling the truth?

You do not. It is worth saying that before saying anything else, because the answer decides which of two quite different things you are buying, and the difference is not a feature comparison. It is a difference in what you are able to prove.

Two ways to know

Reported tells you what things cost. Observed tells you what happened. Those sound like the same sentence and they are not remotely the same claim.

Reported is self-reported, which is exactly as strong as it sounds. A determined person could send whatever they liked. For the question it is built to answer — what is this team’s AI work actually worth, and is the plan we are on the right one — that is usually fine, because nobody has much motive to inflate their own token count. For the question an auditor asks, it is not fine at all, and no amount of product design makes it so.

What each one can evidence

Databricks could find roughly half a million dollars a year of wasted tokens in about an hour because they were firmly in the second category. The trace already existed for every tool call. They only had to ask it a question.

Why reported usage stays off the ledger

The ledger in Shield is append-only and hash-chained: each entry carries a SHA-256 of the one before it, so a record cannot be altered or removed without breaking the chain from that point on. That property is the entire value of it. It is what lets you hand the thing to somebody who does not trust you and have it still mean something.

Self-reported totals are not that. If they were written into the same chain, every entry in it would inherit their weakest property, and the ledger would quietly stop being evidence of anything while continuing to look exactly as authoritative as before. So reported usage is held somewhere else, and every screen that shows a reported figure says where it came from.

The trade nobody puts on a slide

Observed mode needs API keys, and API keys cost more than subscriptions. On my own measured usage — 17,300 Claude Code turns over eleven weeks, described in the previous piece — the same work priced out at about nine times the subscription. That is one heavy user’s ratio and yours will differ, but the direction does not: moving a team from personal subscriptions to a gateway is a real increase in spend, in exchange for control and evidence.

Which means the sequence matters more than the choice. Most teams should start reported, find out what their usage actually is, and move when compliance makes the decision — not when cost does. Cost arguments point the other way, and a team that migrates to API keys for cost reasons without measuring first has usually made their bill worse in the name of making it visible.

The banks and regulated businesses we build Shield for do not get that choice for long. Once staff are putting customer data anywhere near a cloud model, being able to show what was shared, with whom, and what was masked before it left stops being an efficiency question. Shield is built for the obligations in DPDP-2023 and the RBI IT framework, and it ships with policy packs for both — the compliance itself remains yours, as it always does, but the evidence is something we can help you produce.

Which one are you buying?

If the question in the room is what is this costing us, reported answers it today, for nothing, without asking a single developer to change how they work. If the question is what did somebody paste into a model last Tuesday, only observed answers it, and no reading of a local transcript ever will.

Most organisations need the first one now and the second one later. Being clear about which is which is the only way the second one is worth anything when it arrives.