BABCO LABS CONTROL PLANEOfficial AI cost, connection, and reconciliation governance
Checking service…
Checking sign-in…
Sign in with Microsoft

HOW TO USE THE CONTROL PLANE

Install once.
Approve once.
Stay reconciled.

This is the complete operating procedure for every current and future Babco application that uses OpenAI and needs official cost reconciliation.

Open Connect Apps Developer API reference

THE WHOLE HANDSHAKE

App installs connector→App requests access→You approve→Encrypted activation→Usage and reconciliation
1

START IN THE APPLICATION PROJECT

Give the connector ZIP to the app's coding chat

Upload the approved Babco Control Plane Automatic Connector ZIP to the ChatGPT or Codex project that works on that application's backend source code.

Use one connector installation per deployed application environment. Development, staging, production, and shared environments must remain separately attributable.
2

GIVE ONE CLEAR INSTRUCTION

Paste the installation instruction

Tell the coding agent to read the package, install it into the backend, test it, deploy it, and stop only when the deployed app has submitted a live connection request.

Read every file in the uploaded Babco Control Plane Automatic Connector package.

Begin with COPY_PASTE_INSTALL_PROMPT.txt.

Install the connector into this application's backend, test it, deploy it, and stop only when the deployed application has submitted a connection request to the live Control Plane.

Do not ask me for a Control Plane credential. The application must receive its credential automatically through the encrypted approval handshake.
3

DEVELOPER WORK

The developer or coding agent integrates it

The connector is added to the backend and connected to the app's OpenAI call paths, usage reporting, official reconciliation retrieval, and protected persistent connector storage.

  • The connector creates its own RSA identity.
  • It signs its request and polls the same request until a decision is made.
  • It decrypts the approved credential only inside the application.
  • It preserves durable outbox and request-ID deduplication behavior.
4

DEPLOY

The application is deployed

On first startup, the deployed backend automatically creates its cryptographic identity, sends the connection request, receives a verification code, and begins polling for approval.

No Control Plane credential is required before deployment. The connector must not block the application's normal startup or health endpoint while it waits.
5

YOUR FIRST ACTION

Open Connect Apps

Open the Control Plane's Connect Apps tab. The deployed application's request appears automatically in the pending approvals section.

6

VERIFY IDENTITY

Match the verification code

The app's coding agent reports a code such as ABCD-2345. Find the pending request showing the same code. This protects against approving the wrong application instance.

7

VERIFY ATTRIBUTION

Select the exact registered application

Choose the precise Control Plane application and environment, such as Cost Accountant — Shared or Future ERP — Production.

The Control Plane checks that the request's OpenAI project, environment, and provider match the selected registration. A mismatch is rejected.

8

AUTHORIZE

Tap Approve connection

The Control Plane generates a new scoped application key, leaves existing credentials valid, encrypts the new credential to the requesting application's public key, and makes only the encrypted envelope available to that application.

The plaintext credential is never displayed to you. It is not copied into the browser, ChatGPT, GitHub, a ticket, or a settings screen.
9

AUTOMATIC ACTIVATION

The application activates itself

The connector polls the approved request, retrieves the encrypted envelope, and decrypts it using the private key that never left the application. The connector can then authenticate to the existing app-scoped Control Plane APIs.

10

LOCAL USAGE

The application reports OpenAI usage

Every OpenAI response is reported with the model, provider request ID, input tokens, cached input tokens, output tokens, request count, feature, status, and local estimated cost.

Telemetry failure must never break a successful user operation. The application queues and retries safely.

11

OFFICIAL RECONCILIATION

The application retrieves its official reconciliation

The connector calls the application-scoped summary endpoint and receives three sections:

localWhat the application reported
officialOpenAI organization usage and cost
reconciliationVariance and review status

The application uses official.costUsd as the authoritative final OpenAI cost.

12

VERIFY BEHAVIOR

The Control Plane shows the app as Connected

Once the application sends its first real usage event, its application card changes to Connected. Before that event, an approved application appears as Awaiting first event.

Connected is behavioral evidence. It is not awarded merely because a credential exists.
✓

YOUR ROLE FROM NOW ON

Four actions. Nothing else.

  1. Open Connect Apps.Go to the pending approvals section.
  2. Match the verification code.Confirm it is the same code reported by the deployed application.
  3. Select the correct app and environment.Confirm the OpenAI project and deployment environment agree.
  4. Tap Approve connection.The connector and Control Plane complete everything else automatically.

There is no manual credential-installation step.