Frequently Asked Questions

Behest is the control plane for enterprise AI. It sits between your apps and your AI providers so every model call is visible, attributed to its owner, and kept within budget and policy. AI Token FinOps is its cost-control layer, with AI Governance (PII redaction, prompt-injection defense, model allowlists) and cost-aware routing built in. One control plane that stops shadow AI and runaway token costs.

An AI Backend as a Service is the complete infrastructure layer between your application and your LLM provider. Instead of building and maintaining authentication, CORS proxies, PII protection, rate limiting, conversation memory, and observability yourself, you get all of it out of the box with a single API integration. It allows frontend developers to build secure AI apps without writing backend code.

Point your frontend directly at your Behest project URL. Behest handles CORS natively, so your browser-based app can call the AI API without a backend proxy. Request a trial at behest.ai/trial, then create a project, configure your allowed origins, and make standard fetch calls from your React, Vue, Svelte, or vanilla JS frontend. No server code required.

Hours, not months. Once your trial request is approved, create a project, copy your API key, and point your apps at your project URL. Cost tracking, budgets, sign-in checks, rate limiting, memory, and observability are live immediately. AI Governance controls such as PII scrubbing and prompt-injection defense are included on the Enterprise plan.

No. Behest uses an OpenAI-compatible REST API. Any HTTP client works — fetch, axios, requests, curl, or any language that can make HTTP POST requests. There is no proprietary SDK to learn or maintain.

AI FinOps is the broad discipline of managing what an organization spends on AI, mostly from the monthly provider bill. AI Token FinOps manages AI cost at the unit level, the token, in real time. AI FinOps says you spent $50,000 on OpenAI last month; AI Token FinOps shows which user, project, and session spent it, and enforces hard budgets before the spend happens.

AI Token FinOps is the cost-control layer of an enterprise AI control plane. It brings attribution, budgets, forecasting, and real-time enforcement down to the model-call level, so companies can understand and control AI spend before the provider invoice arrives. Behest attributes every dollar to specific users, projects, and sessions so CFOs and platform teams can plan, forecast, and enforce budgets.

Yes. AI Token FinOps is FinOps for AI applied at the token and request level. FinOps for AI (also called AI FinOps) is the broad discipline of bringing cloud-cost rigor to AI spend; Behest's AI Token FinOps is the enforcement layer that attributes every token and blocks budget overruns on the request path, our approach to token economics (tokenomics).

Behest sits in the request path, unlike observability tools that only report costs after the fact. You set hard token or dollar budgets per project, user, or department. If a request would exceed its budget, Behest blocks it instantly, preventing runaway costs before they reach your OpenAI or Anthropic invoice.

Behest's BYOAK v2 (Bring Your Own API Key) allows you to securely store provider keys per tenant or department. When a department makes an LLM request, it routes through their specific provider account. This means the actual LLM invoice from OpenAI or Google goes directly to that department, providing perfect billing isolation and eliminating the need for complex internal chargeback accounting.

AI bills run high because retries and multi-step agent loops turn one task into many model calls, reasoning models burn more tokens per answer, and shadow AI adds spend nobody approved. Most teams also have no per-team or per-user attribution, so nobody can see who spent what. Behest, the control plane for enterprise AI, attributes every model call to an owner and enforces hard budgets before the invoice arrives.

Track AI spending by attributing every model call as it happens. Behest tags each request's model, tokens, and cost to a user, project, session, and cost center, so spend rolls up per team instead of arriving as one provider invoice. You get chargeback-ready showback views, per-team budgets, and forecasts, accurate in real time because attribution happens on the request path, not in month-end log analysis. This is AI Token FinOps.

Yes. AI Token FinOps, the cost-control layer of the Behest control plane, builds attribution, budgets, and enforcement into the platform, so a platform, finance, or engineering owner gets them without standing up a FinOps function or hiring a FinOps analyst. Every model call is attributed to a user, project, and session, hard budgets block overruns before the invoice, and chargeback-ready exports plug into the finance reporting you already have.

Yes, in two ways. Attribution and hard budgets stop waste and overruns before the invoice arrives, and cost-aware routing sends each request to the cheapest model that meets your quality bar, for up to ~30% lower AI costs depending on use case. Because Behest is a flat SaaS license rather than a percentage of spend, the savings stay yours.

Behest provides the technical controls required by emerging AI regulations. This includes immutable audit trails of all AI interactions, model allowlists to prevent the use of unapproved shadow IT models, and built-in guardrails (PII redaction and prompt injection defense) that map directly to NIST AI RMF risk management requirements.

Model allowlists let administrators strictly define which LLMs can be used by which applications or departments. If a developer tries to call an unapproved model (e.g., an experimental model that hasn't passed legal review), Behest blocks the request at the gateway level, ensuring enterprise-wide policy enforcement.

On the Enterprise plan, Behest includes PII Shield, powered by Microsoft Presidio. It operates in three modes: disabled, shadow (log but allow), and enforce (actively protect). In enforce mode you choose mask (reversible tokenization), redact (permanent removal), or block (reject the request). PII is detected with named entity recognition and regex patterns before it reaches the model.

On the Enterprise plan, Behest includes Sentinel, an automatic prompt-injection defense. It uses multiple detection patterns to identify common jailbreak techniques, plus custom blocklists per project, and runs in three modes: disabled, shadow (log detected attacks), and enforce (block malicious prompts). All detection happens before the request reaches the model.

Yes. API keys are hashed with Argon2id, JWTs use RS256 signing, and tenant isolation ensures one customer's data is never accessible to another. Behest runs as SaaS by default; Enterprise customers can self-host Behest in their own cloud infrastructure so keys and data are processed in their environment and, with self-hosted models, stay there.

Both. Behest runs as SaaS in our cloud, or — on the Enterprise tier — self-hosts the control plane in your own cloud (VPC). With the self-hosted option, your keys, prompts, and completions are processed in your environment. With self-hosted models, your data stays in your infrastructure end-to-end; when you connect an external provider like OpenAI or Anthropic with your own key, only the PII-scrubbed request egresses, to the destination you choose. You own the keys and control egress.

Yes. Behest records every AI call with model, tokens, cost, user, project, and session, alongside security events such as PII redactions, blocked prompt-injection attempts, and budget denials — the evidence your auditors look for. With the Enterprise self-hosted option, you run the observability stack (OpenTelemetry and Grafana) in your own cloud.

Behest does not hold its own SOC 2, HIPAA, or ISO 27001 certification today; formal SOC 2 is on our roadmap. What Behest provides are the technical controls your auditors look for — an optional self-hosted deployment, a full audit trail, per-tenant and per-user access control, and PII scrubbing — so it can run inside the boundary you have already audited and supports your SOC 2, HIPAA, or GDPR program. Whether your program meets a framework is a determination you make with your auditor.

Most LLM providers (OpenAI, Anthropic, Gemini, and others) block browser requests because they do not support CORS. Behest solves this with per-project CORS configuration. Set your allowed origins in the Behest dashboard, and your frontend JavaScript can call the Behest API directly — no backend proxy needed.

Behest routes across all major LLM providers: OpenAI, Anthropic, Gemini, and others. Bring your own provider keys (BYOAK v2) for direct billing, or use the Behest-managed default (Gemini 2.5 Flash / Pro on Vertex AI) on the Free tier.

Behest uses the OpenAI-compatible API format. Send a POST request to /v1/chat/completions with an Authorization bearer token, a model name (e.g., gemini-2.5-flash), and a messages array. The response includes choices with message content, finish reason, and token usage statistics. Rate limit headers are included on every response.

Yes, on the Enterprise plan. SaaS in Behest's cloud is the default, with nothing to operate. Enterprise customers can instead self-host Behest in their own cloud: Helm charts for Kubernetes (GKE Autopilot recommended), Docker Compose for local development, and ArgoCD for GitOps. With the self-hosted option your data is processed in your infrastructure; with self-hosted models it stays there, and with an external provider only the PII-scrubbed request leaves.

Behest stores conversation history per-user, per-session in Redis. You can configure the memory window from 0 to 100 message pairs. Memory is automatically injected into the LLM context, trimmed when it exceeds the window size, and can be cleared via API.

Behest enforces three tiers of rate limiting: configurable per-IP rate limiting (safety net), per-project (configurable from 1 to 10,000 requests per minute), and per-user (derived from project limits). Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) are included on every response so your app can handle limits gracefully.

Behest is a SaaS license, not a token markup business: you pay for the platform, never a per-token surcharge on model calls. Plans are Free (an evaluation sandbox), then quote-based Growth, Business, and Enterprise, sized to your annual AI spend. Request a trial at behest.ai/trial, or book a demo for a quote.

Yes. Request a trial at behest.ai/trial and our team sets up a free evaluation sandbox: one project with daily token and request caps, running on a Behest-managed model. It includes sign-in checks, rate limiting, conversation memory, and observability, so you can evaluate Behest on a real use case. The sandbox does not include the AI Token FinOps dashboards, cost-center rollups, or Enterprise-plan governance controls; book a demo to see those.

Spreadsheets and the monthly provider invoice tell you what you already spent, in aggregate, after the money is gone. Behest is real-time AI Token FinOps: every model call is attributed to a user, project, and session as it happens, and hard budgets block overruns before they reach the invoice. You move from reconciling AI spend to controlling it.

Legacy gateways are primarily for routing and observability. Behest is the control plane for enterprise AI: it adds AI Token FinOps (hard budget enforcement before the invoice, per-session cost attribution, and clean chargebacks) plus AI Governance (PII redaction, prompt-injection defense, model allowlists) on the Enterprise plan. If you need enterprise cost control and audit-ready records, Behest provides the guardrails gateways lack.

Cost dashboards and observability tools watch your AI spend after the fact: logging, monitoring, and analyzing usage. Behest governs it on the request path: it attributes every token to a user, project, and session and enforces hard budgets before the spend happens. Observability tells you what you spent; AI Token FinOps stops the overspend.

OpenAI gives you the model and a monthly bill. Behest puts that spend under control: every call is attributed to a user, project, and session, hard budgets stop runaway loops before they hit the invoice, and PII scrubbing and prompt-injection defense run on the request path. Calling OpenAI directly, you learn what you spent after the fact; with Behest you govern it as it happens, and your own provider keys keep billing clean.

An AI gateway sits in front of your LLM to route, log, and cache requests. An AI backend operates the full stack: authentication, CORS, conversation memory, PII scrubbing, prompt-injection defense, rate limiting, token budgets, and observability. A gateway observes; a backend operates. Behest is the control plane for enterprise AI, with AI Token FinOps as its cost-control layer and governance built in; it can also serve as your AI backend.