Usage Flow
This document explains how usage moves through the VARICON pipeline, from anomaly detection to billable intelligence.
For conceptual billing, see Billing Overview. For metering details, see Usage Tracking.
Overview
VARICON is a report-driven system.
Usage is not measured at the moment of raw API traffic. It is measured later, when anomaly processing reaches the intelligence layer.
This is important because it means:
- capture is not billed
- detection is not billed
- only enriched analysis is billed
Usage flow diagram
Step-by-step flow
1. API tests run
A workflow executes API tests using an external runner such as Newman.
2. Report is generated
The test runner produces a structured report containing anomaly transport signals.
3. Anomalies are extracted
VARICON parses the report and extracts encoded anomaly events.
4. Canonicalization
Raw anomaly events are normalized into a stable internal working shape.
5. Fingerprinting
Each anomaly is assigned a deterministic identifier for tracking and deduplication.
6. Enrichment
The anomaly enters the intelligence layer for classification, prioritization, or deeper analysis.
7. Usage is counted
This is the billable point in the flow.
1 enriched anomaly = 1 usage unit
8. Projection
The safety boundary filters data based on the selected mode.
9. Artifacts are written
The pipeline produces final outputs such as JSONL and Markdown reports.
Why usage is counted after enrichment
Usage is counted after enrichment because this is where customer value becomes materially different from free detection.
Before enrichment, VARICON is primarily:
• extracting • formatting • reporting
After enrichment, VARICON is: • interpreting • prioritizing • assigning meaning
That is the monetizable step.
What is not counted
The following do not create paid usage by themselves: • report generation • anomaly extraction • fingerprinting • projection • artifact writing
These are part of the open-core or baseline pipeline.
What is counted
Usage is counted when an anomaly receives paid intelligence work, such as: • classification • severity assignment • remediation guidance • advanced interpretation
Fail-open behavior
If enrichment does not complete successfully: • the anomaly can still flow through the pipeline • reports can still be generated • usage should not be counted for incomplete enrichment
This ensures that billing only happens when value is actually delivered.
Summary
VARICON usage flow is designed so that: • free detection remains free • paid value starts at enrichment • billing tracks interpretation, not raw traffic
Usage begins where understanding begins.