Every board is asking what the superintelligent AI agents cost. The invoice only ever recorded the tokens — never the human drag, the shadow spend, the waste or the risk. AIM CFO is the ledger that does — every agent's cost, contribution and waste, priced from the same verified source that secures your fleet. It rides on AIM Sec: the CFO cannot price an agent AIM Sec has not first proven exists.
Below — the CFO cockpit for agent costs. Figures shown are an illustrative sample; in production the plane reads your live fleet.
🖥️ CFO · CISO · CIO — one console, one truth · the situation room
Every agent, with its price, on one screen. The CFO gets the Agent P&L — every agent's cost, contribution, human drag and waste, read from the same verified ledger that secures the fleet. The CIO sees the fleet and the CISO the exposure; the CFO sees what it all costs — and, from two buttons only, revokes or submits to committee, where the CIO and CISO decide together in the situation room. One console, one truth, each chair its own view. Click any agent to open its cost case.
Contribution margin — by agent
a negative-margin agent costs more than it returns — act on the row
Agent
Department
Work displaced
Run cost
Human drag
Margin
Action
AG-1042 · reconciliation
Finance
€45,320
€6,710
€2,090
+€36,520
—
AG-0871 · claims triage
Ops
€31,570
€4,840
€2,310
+€24,420
—
AG-1330 · contract review
Legal
€13,640
€4,290
€16,280
−€6,930
AG-0455 · report drafting
Marketing
€3,410
€9,570
€10,340
−€16,500
AG-0918 · (no activity)
IT
€0
€12,760
€0
−€12,760
You cannot switch an agent off from this screen — and neither can anyone else on
their own. Switching off an agent for economic reasons is a joint decision: it is proposed, your colleagues see
what the agent actually does, and any one of them can stop it. Immediate containment of a compromised agent is the
Blue Team's call, and it does not wait for anybody.
Departments — ranked by contribution
€ / agent is the number to manage on — not the total
Best: Finance· Needs intervention: Legalby contribution per agent
#
Department
Agents
Displaced
Cost
Drag
Waste
Net contribution
€ / agent
Margin
1
Finance
268
€292,820
€106,040
€13,860
€9,790
+€163,130
+€608
55.7%
2
Support
126
€93,390
€38,170
€5,610
€3,520
+€46,090
+€366
49.4%
3
Sales
78
€57,310
€24,090
€11,220
€2,310
+€27,170
+€349
47.4%
4
Ops
3 of 351 agents negative
351
€285,010
€141,130
€21,780
€16,060
+€106,040
+€302
37.2%
5
IT
22 of 217 agents negative
217
€126,720
€81,620
€8,690
€45,430
−€9,020
−€42
−7.1%
6
Marketing
14 of 113 agents negative
113
€44,220
€27,280
€11,000
€14,960
−€9,020
−€80
−20.4%
7
Legal
9 of 104 agents negative
104
€51,590
€35,860
€13,640
€13,970
−€11,880
−€114
−23.0%
—
R&D (pilot)
0
—
—
—
—
—
no agents
—
Read the € / agent column, not the total. Ops is 2nd by total contribution
(€106,040) on 351 agents — but only 4th per agent, behind Support (126 agents) and Sales (78).
Total contribution rewards whoever deployed the most agents; € / agent tells you who is running the better
operation, and where to intervene.
Department drill-down — the agents inside a department
select a department · open any agent for the full detail window · revoke, or submit to the situation room
Department:showing 24 of 217 agents · 22 negative-margin
Agent
Mission
Work displaced
Run cost
Human drag
Margin
Action
AG-3918
contract review
€0
€660
€0
−€660
AG-3971
report drafting
€330
€330
€660
−€660
AG-4024
invoice matching
€330
€330
€0
−€330
AG-4077
forecast build
€440
€660
€0
−€220
AG-4130
ticket triage
€550
€660
€110
−€220
AG-4183
lead scoring
€0
€770
€0
−€770
AG-4236
payout approval
€330
€330
€550
−€550
AG-4289
data extraction
€440
€330
€0
−€220
AG-4342
compliance check
€440
€550
€0
−€110
AG-4395
renewal outreach
€440
€550
€110
−€220
AG-4448
fraud screen
€0
€660
€0
−€660
AG-4501
KYC review
€330
€330
€660
−€660
AG-4554
spend analysis
€440
€330
€0
−€220
AG-4607
dunning outreach
€550
€1,210
€0
−€660
AG-4660
reconciliation
€440
€550
€110
−€220
AG-4713
claims triage
€0
€550
€0
−€550
AG-4766
contract review
€330
€330
€660
−€660
AG-4819
report drafting
€440
€330
€0
−€220
AG-4872
invoice matching
€440
€550
€0
−€110
AG-4925
forecast build
€440
€550
€110
−€220
AG-4978
ticket triage
€0
€660
€0
−€660
AG-5031
lead scoring
€330
€330
€550
−€550
AG-5084
payout approval
€440
€330
€0
+€110
—
AG-5137
data extraction
€550
€330
€0
+€220
—
Click an agent code to open the full detail window · or act on a row: Revoke requests a stop through the situation room; Submit to committee puts it on the room's agenda. Nothing is switched off from this screen.
The waste ledgerspend that produced nothing — itemised, in euros€106,040
Blocked-loop burnagents that keep retrying work the gate refuses · 34 flagged€23,430
Duplicate missiontwo departments, one mission, paid twice · 18 flagged€16,390
Shadow spendagents nobody registered — spend nobody authorised · 27 shadow agents · FLOOR, not a measurement€24,860
Out-of-window burnactions fired outside the declared operating period · 12 flagged€10,120
Over-scoped mandateauthority granted and never once used · 9 agents over-scopedNot enough data yet— we can PROVE the over-scope and itemise it, but we cannot honestly price it. Shown, not guessed.
Budget caps & this ledgerADVISORYREPORT ONLY. This cockpit computes and reports; it enforces nothing.
📩 Daily digest2026-03-31
Yesterday's agent payroll. 3 agents ran at a negative contribution margin.
Run cost (agent spend)€14,652
Work displaced€28,160
Human drag€2,530
Waste€3,421
Contribution margin+€7,557
AG-1330Legal−€231
AG-0455Marketing−€528
AG-0918IT−€413
the same figures your board will be shown
Every figure above is computed from your own fleet at your own contracted rate. Where we cannot yet
compute a line, we say so — we do not fill the gap with an estimate.
👁️ Discovery — the agents nobody declaredshadow agents surface the moment they act — not at the next audit
Passport coverage
99.8%
passported vs discovered
Shadow agents
4
no passport — contained
Passported
2,003
under governance
Quarantined
1
held pending decision
🔺 The lethal trifecta — the three legs that make an agent dangerousprivate data × untrusted content × outbound action · break ONE leg and the agent is structurally safe
🔺 All three legs
1,102
56% of the fleet — turnable by content alone
Private data
1,354
reads confidential / restricted / PII
Untrusted content
1,758
ingests web, mail, files, customer text
Outbound action
1,791
can move money, write, send, sign
🎯 Mandate drift — is it still doing the job it was bonded to do?it is still itself — but is it still doing its job?
🎯 Off-mandate
202
observed outside the declared charter
Undeclared tool
126
reached a tool it never declared
Data-class breach
76
touched data above its classification
Within mandate
1,766
operating inside its charter
🧰 AI-BOM — the agent's bill of materialsmodel · tools/MCP · attestation — the agent-native bill of materials, beyond legacy software SBOM
Tools in the fleet
14
distinct tools / MCP servers reachable
Manifests signed
1,741
attested at passport issue
🧰 CHANGED since issue
118
the tool moved under the agent
Unsigned
109
no attestation — cannot be trusted
⏱️ Time to contain — the only SOC clock that mattersthe attacker is a machine · so the responder must be one too
⏱️ Time to contain
1 click
from decision to contained
Contained now (OFF)
35
fail-closed — cannot act
Detect → contain gap
CLOSED
no window between the alarm and the stop
High-authority, still live
471
trifecta agents awaiting a decision
Most teams can detect a misbehaving agent long before they can actually stop one. Blast radius keeps accumulating in the gap between detect and terminate — and that gap is where the damage happens. AIM closes it.
🕸️ Contagion cone — revoke the agent, quarantine the coneagents trust each other by default · a compromised agent poisons everything downstream of it
Widest cone
9
the fleet's largest blast radius (≤3 hops)
Direct (1 hop)
3
consumed its output first-hand
Fund-moving in the cone
3
critical-tier agents downstream
Quarantined
0
held, pending review
🧠 Memory & reinstatement — a new passport on a poisoned brainrevoking the identity does not clean the memory · if it re-attaches to the same store, you have the same problem
🧠 Stores attested
1,968
every memory has a birth certificate
☣️ Suspect memories
1,371
untrusted source, or written in the window
🚫 Re-enrolment blocked
151
a clean identity for a poisoned brain — refused
👮 On probation
126
back, but not at full authority
⚛️ Quantum — every agent carries a post-quantum passportML-DSA-87 · FIPS 204 birth certificate · harvest-now-decrypt-later proof
Quantum-safe passports
1,956
99.4% — ML-DSA-87 (FIPS 204)
Post-quantum standard
ML-DSA-87
FIPS 204 birth certificate
Keys expiring ≤7d
58
auto-renew before lapse
Rotation due
24
scheduled key rotation
Legacy / at-risk
12
flagged for PQ upgrade
⚖️ Legal & GDPR — data stays where the law requiresenforced BEFORE data enters the agent — a bad transfer is prevented, not logged
EU / PII-data agents
748
handle personal / regulated data
In-region — no egress
748
data pinned to EU · fail-closed
Cross-border blocked (30d)
27
stopped before data left context
Exec-consent gated
94
needs sign-off to transfer
DPA on file
✓
controller ↔ processor agreement
A non-compliant transfer is prevented, not logged after the fact. EU / PII data does not leave the region or the company without policy and executive consent. Transfer decisions carry the largest GDPR fines on record (€1.2B Meta, Irish DPC 2023; €583M TikTok, Irish DPC 2025). Full audit trail for the DPO.
🔒 The data-to-model gate — only authorized data ever reaches a model
🤖 Agentwants to call a model
data →
⚖️ AIM gatepassport · data class · region · consent
→
✅ Authorized → data reaches the model
🛑 Unauthorized → blocked at the gate, before it leaves (fail-closed)
Static tools flag the leak after it happens. AIM decides at the gate — the unauthorized data never reaches the model.
Interactive preview — this is a design demonstration, not a live tenant. This is the AIM Blue-Team plane for an agent fleet: fleet health and the exception queue; the discovery census that surfaces the agents nobody declared; the lethal trifecta score (private data × untrusted content × outbound action); mandate drift; tool / MCP attestation; time to contain; and the contagion cone — revoke an agent and quarantine everything downstream that acted on its output. The Onboard agent flow lets you pick a division or create a new one. Figures here are seeded to demonstrate the design; in production the plane reads your live fleet. Nothing is written from this preview.