Reference Architecture Diagram + Narrative (measure → allocate → optimize → attest)
┌─────────────────────────────────────────────────┐
│ SOURCES OF USAGE │
Cloud (IaaS/PaaS/SaaS) │ Colo/DC (power/PUE) │ Network/CDN/SIP │ GPU/AI │
Bills/ CURs / APIs │ Meters (kWh), DCIM │ NetFlow, QoE │ Jobs │
└───────────────┬───────────────┬────────┬────────┘
│ │ │
▼ ▼ ▼
┌──────────────────────────────────────────────────────────┐
│ COLLECTORS & NORMALIZATION (ETL/ELT + Streaming) │
│ • Vendor APIs (CUR, billing) • DCIM/meters • NetFlow/IPFIX│
│ • SKU/region maps • Instance/volume tags • Labels │
└──────────────┬──────────────────────────────┬─────────────┘
│ │
▼ ▼
┌──────────────────────────────────────┐ ┌────────────────────────────────────┐
│ COST & ALLOCATION ENGINE │ │ CARBON & ENERGY ENGINE │
│ • Showback/chargeback rules │ │ • Emission factors (vendor/region)│
│ • Tagging remediation / heuristics │ │ • Scope 1/2/3 mapping (GHG Prot.) │
│ • Shared spend apportionment │ │ • Location vs market-based calc │
│ • Budgets & alerts (per BU/service) │ │ • EAC/REC offsets & provenance │
└───────────────┬──────────┬──────────┘ └───────────────┬──────────┬─────────┘
│ │ │ │
▼ ▼ ▼ ▼
┌───────────────────────────────┐ ┌──────────────────────────────┐
│ OPTIMIZATION RECOMMENDATIONS │ │ POLICY & GUARDRAILS │
│ • Rightsize/stop/scale-to-zero│ │ • Budget caps, alerts, freeze│
│ • Reserved/Savings coverage │ │ • Egress/CDN/cache policies │
│ • Storage tiering/lifecycle │ │ • GPU/AI queues/schedules │
│ • Data egress / placement │ │ • Sustainability SLOs (gCO2e)│
└──────────────┬───────────────┘ └──────────────┬───────────────┘
│ │
▼ ▼
┌──────────────────────────────────────┐ ┌──────────────────────────────────┐
│ WORKFLOWS & APPROVALS (ITSM/CMDB) │ │ REPORTING & ATTESTATION │
│ • Change tickets for actions │ │ • Exec dashboards (cost/carbon) │
│ • CAB gates for risky savings │ │ • SEC/CSRD/ESG packs (WORM) │
│ • Owner routing (service/BU) │ │ • Supplier scorecards, offsets │
└──────────────────────────────────────┘ └──────────────────────────────────┘
Telemetry loop ──► AIOps (anomaly, forecast) • SIEM/SOAR (fraud/leak) • GRC (policy) • Data Catalog/Lineage (source-of-truth)
Narrative (how money and carbon stay visible, governed, and reduced)
1) Purpose & posture
- Objective: Create a cross-domain fabric that ingests real usage, allocates cost and carbon to owners/services/regions, drives optimization safely, and produces audit-ready attestations (SEC/CSRD/GHG Protocol).
- Posture: Data-first, policy-led budgets, owner-routed actions, and immutable proof of both financial and environmental stewardship.
2) Ingest & normalize (syntax)
- Pull cloud bills/CURs, SaaS invoices, DCIM meters (kWh, PUE), NetFlow/CDN/SIP minutes, GPU job hours.
- Normalize SKUs to internal service taxonomy; enrich with tags/labels and business owner from CMDB; backfill missing tags via heuristics.
3) Allocate (semantics)
- Showback/chargeback by service/BU/region/environment; apportion shared assets (egress, NAT, firewalls) with rules that survive audit.
- Budgets drive alerts; forecasts blend seasonality and planned events (launches, sports, holidays).
4) Carbon quantification (meaning + custody)
- Compute Scope 2 (location- vs market-based) with grid factors; Scope 3 (use of cloud services) with vendor-published EF or credible proxies.
- Track EAC/REC purchases and attach them to accounts/regions; store provenance and retirement certificates immutably.
5) Optimize (grammar of safe change)
- Recommendations include rightsizing, stop/hibernate windows, reserved/Savings plans, storage lifecycle, CDN cache improvements, egress minimization (data placement), GPU queueing/scheduling, model distillation.
- Each action is runnable via ITSM (change ticket), checked against SLO/SLA and compliance (PCI/PHI residency). Auto-rollback hooks are required for risky moves.
6) Guardrails & policy-as-code (pragmatics)
- Enforce budget caps and carbon SLOs (e.g., ≤X gCO₂e/request, ≤$ per 1k requests).
- Gate deployments that violate residency/egress/cost guardrails (ties to DevSecOps/GitOps, Arch 19) and Zero-Trust access fabric (Arch 16).
7) Reporting & attestation (truth on demand)
- Executive dashboards: unit economics ($/request, $/GB, $/agent-hour) + carbon intensity (gCO₂e/request, gCO₂e/GB).
- Regulatory packs: SEC climate, CSRD, ESG—with data lineage, emission factors, and offset proofs in WORM storage.
8) Resilience & integrity
- AIOps detects anomalies (sudden cost spikes, rogue egress); opens ITSM incidents.
- SIEM/SOAR flags fraud/leak (unexpected data transfer patterns) and can auto-throttle egress/CDN; every change is auditable.
Reference KPIs
- Unit cost$/request, $/GB, $/agent-hour (trend ↓ month-on-month)
- Carbon intensitygCO₂e/request or gCO₂e/GB (trend ↓)
- Coverage≥98% spend/tag attribution; ≥95% carbon attribution
- Savings realized≥70% of accepted recommendations in 90 days
- Budget variance≤5% per BU/service; Alert MTTA: <15 min
Minimal BOM (aligned with prior stack)
Collector/ETL for bills & meters, SKU maps, Tagging remediation, Allocation engine (showback/chargeback), Carbon factors/registry, Optimization engine, Budget/guardrail policy-as-code, ITSM/CMDB integration, AIOps (forecast/anomaly), SIEM/SOAR hooks, Reporting (dashboards + ESG packs), WORM evidence store, Data catalog/lineage.
Key terms in plain language
Open a term for a concise explanation of language used on this page.
Service-Level Agreement (SLA)
A provider’s written commitment covering service targets such as availability, response time, repair time, and sometimes financial credits when commitments are missed.
Cloud Computing
Computing resources—such as applications, servers, storage, or databases—delivered from remote infrastructure and scaled as requirements change.
Infrastructure as a Service (IaaS)
Cloud-based servers, storage, and networking that customers configure and manage without owning the underlying data-center hardware.
Software as a Service (SaaS)
Software accessed as an online service instead of being installed and maintained entirely on the customer’s own computers or servers.
Zero Trust
A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.
Content Delivery Network (CDN)
A distributed system that serves website or application content from locations closer to users, improving speed, resilience, and capacity.
API
An application programming interface is a defined way for software systems to exchange data or request functions from one another.
Artificial Intelligence (AI)
Software designed to perform tasks involving prediction, classification, generation, reasoning, or decision support. Business use still requires clear data, governance, security, and human accountability.