ISO/IEC 27001:2022 tracing and token accounting architecture for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · ISO/IEC 27001:2022 · layout spec_first · implementation executed in CI before publish

Implementation parameter matrix

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control that resolves this is a Complete-Trace Reconciliation Ledger, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is ISO/IEC 27001:2022, and the question it actually asks is is this risk on the register with a named owner and a treatment. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

Why this blocks production

An answer is disputed weeks after it was given and nobody can say which model version, which documents and which prompt produced it. Traces exist, but they are sampled, so the disputed request is the one that was not kept.

What ISO/IEC 27001:2022 specifically requires

ISO 27001 is a management-system standard: the auditor checks that risks are identified, owned, treated and reviewed on a cycle. A perfect technical control that is absent from the risk register is a nonconformity.

The artifact that satisfies it is risk register entries with owners, treatments and review dates. The way teams most often fail it: a technically sound control that no Statement of Applicability references, so it cannot be evidenced.

Reference implementation — Trace completeness with spend reconciliation

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the Statement of Applicability extract.

"""Trace completeness: every response tied to the inputs that produced it.

The failure: an answer is disputed weeks later and nobody can reconstruct which
model version, which retrieved documents and which prompt produced it. Sampling
traces at 1% guarantees the disputed one is missing, so completeness is the
property to enforce — and untraced spend is the signal that it has broken.
"""
import hashlib


class Trace:
    def __init__(self, request_id: str, model_version: str):
        self.request_id = request_id
        self.model_version = model_version
        self.sources: list[str] = []
        self.prompt_digest = None
        self.output_digest = None
        self.tokens = {"in": 0, "out": 0}

    def bind_prompt(self, prompt: str) -> None:
        self.prompt_digest = hashlib.sha256(prompt.encode()).hexdigest()[:16]

    def bind_output(self, output: str) -> None:
        self.output_digest = hashlib.sha256(output.encode()).hexdigest()[:16]

    def cite(self, source_id: str) -> None:
        self.sources.append(source_id)

    def complete(self) -> bool:
        return all([self.prompt_digest, self.output_digest,
                    self.model_version, self.tokens["in"] > 0])

    def missing(self) -> list[str]:
        gaps = []
        if not self.prompt_digest: gaps.append("prompt_digest")
        if not self.output_digest: gaps.append("output_digest")
        if not self.model_version: gaps.append("model_version")
        if self.tokens["in"] <= 0: gaps.append("token_accounting")
        return gaps


class Ledger:
    """Reconciles traced spend against billed spend. A gap means requests are
    escaping the traced path, which is the thing to find — not a rounding
    error to tolerate."""

    def __init__(self, tolerance: float = 0.01):
        self.traces: dict[str, Trace] = {}
        self.tolerance = tolerance

    def open(self, request_id: str, model_version: str) -> Trace:
        t = Trace(request_id, model_version)
        self.traces[request_id] = t
        return t

    def reconstruct(self, request_id: str) -> dict | None:
        t = self.traces.get(request_id)
        if not t:
            return None
        return {"request_id": t.request_id, "model_version": t.model_version,
                "prompt_digest": t.prompt_digest, "output_digest": t.output_digest,
                "sources": list(t.sources), "tokens": dict(t.tokens),
                "complete": t.complete(), "missing": t.missing()}

    def traced_tokens(self) -> int:
        return sum(t.tokens["in"] + t.tokens["out"] for t in self.traces.values())

    def reconcile(self, billed_tokens: int) -> dict:
        traced = self.traced_tokens()
        gap = billed_tokens - traced
        ratio = gap / billed_tokens if billed_tokens else 0.0
        return {"traced": traced, "billed": billed_tokens, "gap": gap,
                "untraced_ratio": round(ratio, 4),
                "within_tolerance": abs(ratio) <= self.tolerance,
                "incomplete_traces": [r for r, t in self.traces.items()
                                      if not t.complete()]}


if __name__ == "__main__":
    led = Ledger()
    t = led.open("req-1", "gpt-x@2026-09")
    t.bind_prompt("What is our refund policy?")
    t.cite("doc://policies/refunds#v7")
    t.tokens = {"in": 820, "out": 240}
    t.bind_output("Refunds are processed within 14 days.")

    rec = led.reconstruct("req-1")
    assert rec["complete"], rec
    assert rec["sources"] == ["doc://policies/refunds#v7"], rec
    assert rec["model_version"] == "gpt-x@2026-09"

    # An incomplete trace must be visible, not silently acceptable.
    t2 = led.open("req-2", "gpt-x@2026-09")
    t2.tokens = {"in": 100, "out": 50}
    assert not t2.complete() and "prompt_digest" in t2.missing(), t2.missing()

    clean = led.reconcile(billed_tokens=1210)
    assert clean["within_tolerance"], clean
    assert clean["incomplete_traces"] == ["req-2"], clean

    # Requests escaping the traced path show up as an untraced gap.
    leaky = led.reconcile(billed_tokens=4000)
    assert not leaky["within_tolerance"], leaky
    assert leaky["untraced_ratio"] > 0.6, leaky

    assert led.reconstruct("req-missing") is None

    print("Trace completeness ledger: OK")
    print(f"  reconstructed req-1 complete={rec['complete']}, "
          f"untraced ratio clean={clean['untraced_ratio']} "
          f"leaky={leaky['untraced_ratio']}")

The ISO/IEC 27001:2022 control, as code

Statement of Applicability with operating evidence. This is the artifact an assessor asks for under ISO/IEC 27001:2022 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Annex A control to evidence mapping behind a Statement of Applicability.

ISO/IEC 27001:2022 turns on the SoA: every Annex A control is either applicable
with a justification and evidence, or excluded with a justification. The audit
failure is an applicable control whose evidence is a policy document rather
than a record that the control operated.
"""

ANNEX_A_2022 = {
    "A.5.23": "Information security for use of cloud services",
    "A.8.2": "Privileged access rights",
    "A.8.10": "Information deletion",
    "A.8.12": "Data leakage prevention",
    "A.8.15": "Logging",
    "A.8.16": "Monitoring activities",
    "A.8.24": "Use of cryptography",
    "A.8.28": "Secure coding",
}

EVIDENCE_KINDS = {"record", "configuration", "test_result"}
NON_EVIDENCE = {"policy", "intent", "roadmap"}


class StatementOfApplicability:
    def __init__(self, scope: str):
        self.scope = scope
        self.entries: dict[str, dict] = {}

    def apply(self, control: str, justification: str,
              evidence_ref: str, evidence_kind: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if evidence_kind in NON_EVIDENCE:
            raise ValueError(
                f"{control}: {evidence_kind!r} describes intent, not operation")
        if evidence_kind not in EVIDENCE_KINDS:
            raise ValueError(f"{control}: unknown evidence kind {evidence_kind!r}")
        self.entries[control] = {"applicable": True, "justification": justification,
                                 "evidence_ref": evidence_ref,
                                 "evidence_kind": evidence_kind}

    def exclude(self, control: str, justification: str) -> None:
        if control not in ANNEX_A_2022:
            raise KeyError(f"{control} is not an Annex A:2022 control")
        if len(justification.split()) < 5:
            raise ValueError(f"{control}: exclusion needs a real justification")
        self.entries[control] = {"applicable": False, "justification": justification}

    def unaddressed(self) -> list[str]:
        return sorted(set(ANNEX_A_2022) - set(self.entries))

    def certifiable(self) -> dict:
        gaps = self.unaddressed()
        applied = [c for c, e in self.entries.items() if e["applicable"]]
        return {"scope": self.scope, "applied": sorted(applied),
                "excluded": sorted(c for c, e in self.entries.items()
                                   if not e["applicable"]),
                "unaddressed": gaps, "certifiable": not gaps}


if __name__ == "__main__":
    soa = StatementOfApplicability("LLM platform, production tenant")
    soa.apply("A.5.23", "Model inference is a cloud service",
              "cfg://gateway/allowed-providers.yaml", "configuration")
    soa.apply("A.8.2", "Operators hold privileged access to prompts",
              "rec://iam/quarterly-access-review-2026Q3", "record")
    soa.apply("A.8.10", "Retention is enforced on prompt logs",
              "test://retention/expiry-suite-2026-10", "test_result")
    soa.apply("A.8.12", "Egress to model providers can leak data",
              "cfg://dlp/egress-classifier.yaml", "configuration")
    soa.apply("A.8.15", "All inference events are logged",
              "rec://audit/chain-head-2026-10-16", "record")
    soa.apply("A.8.16", "Anomalous usage is monitored",
              "rec://siem/llm-usage-alerts", "record")
    soa.apply("A.8.24", "TLS and at-rest encryption",
              "test://crypto/tls-config-scan", "test_result")
    soa.exclude("A.8.28", "No application code is developed within this scope "
                          "boundary; the platform is configured, not coded")

    report = soa.certifiable()
    assert report["certifiable"], report
    assert len(report["applied"]) == 7 and len(report["excluded"]) == 1, report

    try:
        soa.apply("A.8.15", "we have a logging policy",
                  "doc://policies/logging.pdf", "policy")
        raise AssertionError("accepted a policy document as operating evidence")
    except ValueError:
        pass

    partial = StatementOfApplicability("partial")
    partial.apply("A.8.15", "logging", "rec://x", "record")
    assert not partial.certifiable()["certifiable"]
    assert len(partial.certifiable()["unaddressed"]) == 7

    print("ISO/IEC 27001:2022 SoA evidence mapping: OK")
    print(f"  applied {len(report['applied'])}, excluded {len(report['excluded'])}, "
          f"unaddressed {len(report['unaddressed'])}")

Reference architecture

Complete-Trace Reconciliation Ledger — the request path, with the decision points that must exist before the first model call:

flowchart LR
    REQ[Request] --> OPEN[Open trace<br/>model version pinned]
    OPEN --> CTX[Bind prompt digest + sources]
    CTX --> CALL[Model call] --> OUT[Bind output digest + tokens]
    OUT --> LED[(Ledger)]
    BILL[Provider invoice] --> REC{Reconcile}
    LED --> REC
    REC -->|gap| ALERT[Untraced traffic — find the path]
    REC -->|matches| OK[Completeness holds]

Implementation components

1. Per-request trace — Model version, prompt digest, output digest, sources, tokens.
2. Completeness check — A trace missing any required field is reported, not accepted.
3. Source citation list — Which retrieved documents were in context for this answer.
4. Token accounting — Input and output tokens recorded at the call site.
5. Spend reconciliation — Traced tokens against billed tokens; a gap means untraced traffic.
6. Reconstruction API — Given a request id, return everything needed to re-derive the answer.

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Review questions and answers

• Where is this control in the risk register and the Statement of Applicability, who owns it, and when was it last reviewed?
  Register entries are generated from the deployed control set, so every control has an SoA reference, a named owner and a review date that cannot silently lapse.
• A customer disputes an answer from six weeks ago. What can you reconstruct?
  The model version, prompt digest, output digest, the retrieved sources in context, and token counts — enough to re-derive the answer rather than argue about it.
• How would you know if some requests never reach the traced path?
  Reconciliation. Traced token spend is compared against the provider invoice; a gap beyond tolerance means traffic is escaping the traced path, and that gap is the thing to chase.
• Which model version produced a specific output, and how is that known rather than inferred?
  It is pinned on the trace when the trace opens, before the call. Inferring it afterwards from deployment history is exactly how the wrong version gets attributed.
• Does the trace store the raw prompt, and what does that mean for personal data?
  Digests by default, with raw retained only where there is a lawful basis. The digest is enough to prove which prompt produced which output without storing the text.
• What does tracing add to the latency of the request it traces?
  Nothing on the critical path: trace writes are buffered and asynchronous, and the added p95 is measured against the agreed budget rather than assumed to be negligible.

See also

• Part of enterprise ai compliance architecture.
• A different failure mode of the same component: SOX tracing and token accounting architecture for enterprise LLM.
• This pattern also governs HIPAA tracing and token accounting architecture for enterprise LLM.
• This pattern also governs fedRAMP Moderate tracing and token accounting architecture for enterprise.
• This pattern also governs SOC 2 Type II tracing and token accounting architecture for enterprise.
• If this is the blocker in front of you: enterprise AI infrastructure review.