Everything is correlated by request_id — the same identifier the reservation holds, the usage row carries and the trace links. One identifier answers 'what happened to this request' across all five stages.
Rejections are logged in full; allows are sampled at 1%. Rejections are what a tenant will dispute, and they are a small fraction of traffic, so full retention is affordable.
Lease hit rate is treated as a first-class SLI, not a debug metric. It is the leading indicator for both latency and Valkey load, and it degrades before the p99 does.
The SLOs
Availability 99.99% (52 min/year) · decision p99 < 10 ms with a 4.3 min/month error budget.
Valkey script p99 < 1.5 ms · lease hit rate ≥ 90% · provider failover < 5 s.
Policy staleness < 60 s · usage ledger lag < 5 min.
Privacy constraint
Access logs record no request body. Provider error responses are redacted before they reach Loki, because a provider error can echo prompt content.
Traces carry scope identifiers and token counts as attributes, never message content.
Tenant-facing dashboards are scoped by ClickHouse row policies, so a tenant cannot query another tenant's consumption.
