tack reverses the order. Prepaid wallets, a turn that refuses when the balance is empty, and one number per customer you can invoice on. Agencies run it one project per client. You write the tools and the screens.
For teams that have to charge early.
Every answer costs real money the instant it is generated — before anyone has paid for it, and with no invoice to hide behind. Five beliefs follow from that. Everything below them is what they forced.
| The belief | What it forced | What it buys you |
|---|---|---|
| Never spend money you haven't collected | Prepaid wallet checked before the turn, not after; refusals cost 0 and write their audit row | You stop financing your customers' usage out of your own cash, and a runaway loop can't hand you a bill you can't pay |
| A turn is the unit, not a token count | One metered turn per exchange, rolled up per tenant, priced per class | One number per customer you can put on an invoice — the spread is your margin |
| Proof beats assurance | Usage row and wallet debit committed in one transaction; every turn reconstructible from its span tree | You end a billing dispute with a record instead of an apology |
| A customer is a boundary, not a column | org → project → tenant from migration 0001 — every row, cache key, queue job and trace | Your client never appears inside another client's data, and you can demonstrate it in their security review |
| Access is earned, never assumed | Clearance computed in the engine, failing closed, before context is injected | Your AI cannot be talked into revealing what the person talking to it hadn't earned |
We didn't choose these. We hit all five in production, in this order, before tack existed.
A ship's log is the record that holds up afterwards. tack keeps one for your AI: every turn writes both books, usage and money, committed in one transaction. Both or neither.
From your own signup code. Idempotent: retries can't fork a customer.
Stream the reply over plain SSE. Tools call back into your codebase, signed.
Usage rolls up per tenant. Price your product per turn: the spread is your margin.
Enforced in the schema and the type system, not asserted in comments.
| ID | Guarantee | Mechanism |
|---|---|---|
| MTR-01 | A turn that can't pay never runs | Prepaid wallet checked before every turn; hard cap; the usage row and the wallet debit commit in one transaction. Refusals cost 0 and are audited. |
| ISO-01 | Tenants cannot see each other | org → project → tenant from migration 0001. Every row, Redis key, queue job and trace carries the tuple; a foreign tenant id is a 404. |
| CLR-01 | Access fails closed | Your backend asserts what a user earned; tack computes min(ceiling, earned) once per turn. Unknown rung → ladder floor. |
| TOOL-01 | A broken tool degrades a turn, never kills it | Per-tool timeout resolves to an error envelope; the model works around it. Repeated failure raises tool_degraded: failure is routed, not accidental. |
| AUD-01 | Every AI decision is reconstructible | Span tree per turn, tool inputs/results, clearance verdict, cost by trace id. Cost is read from the ledger, never recomputed. |
Boring technology, arranged carefully. No exotic databases, no bespoke protocols: parts your team already knows how to operate.
Prompt injection is assumed, not hoped away. Controls map to MITRE ATLAS; the adversarial suite replays these classes, against the money path and across tenants, as a release gate.
| ATLAS | Technique | Control |
|---|---|---|
| AML.T0051 | LLM Prompt Injection | Injected instructions can only ask for what the turn could already see: context is clearance-gated before injection, retrieval is tenant-keyed before ranking, a pre-emit guard screens output. Denial by structural absence. |
| AML.T0054 | LLM Jailbreak | Guardrails are semantic judges, not regex lists, running pre-emit inside the stream. Abuse ceilings brake repeat probing. |
| AML.T0057 | LLM Data Leakage | Your sensitivity vocabulary maps to retrieval floors; the reserved never class is structurally unretrievable; redacted fields are stripped before model, storage, webhooks. |
| AML.T0086 | Exfiltration via Agent Tool Invocation | Tools are clearance-gated per turn; tenant identity and the verdict ride the signed server envelope, never the model-visible schema. |
| AML.T0034 | Cost Harvesting | Prepaid wallets, hard caps, fair-use envelopes, per-tenant kill switch. The bill cannot be weaponized. |
| AML.T0029 | Denial of AI Service | Per-tenant concurrency slots, fair scheduling: a hot tenant deepens its own queue, never a neighbor's. |
You can build a wallet in a weekend. You cannot walk into your client's security review and defend a threat model you don't have: mapped controls, a DPA, a versioned sub-processor list, per-turn reconstructible audit. tack's exist today and go out by reply.
Gateways proxy calls, and the good ones now do spend caps and per-customer reporting. A cap bounds your cost after the money is gone: it does not hold your customer's balance, and it will not refuse the turn at the gate with a zero-cost audited row. Frameworks structure code. Billing platforms meter events you define. Running the turn and committing the usage row with the wallet debit — in one transaction — is the part nobody else does. A wallet could be bolted onto any of them. Tenancy in the schema from the first migration, and clearance computed inside the engine, cannot.
| Runs the turn | Keeps the books | Isolates tenants | Unit you can bill on | |
|---|---|---|---|---|
| Model gateways | proxies calls | spend caps, after the fact | cost attribution only | tokens |
| Agent frameworks | in your code | — | — | — |
| Usage-billing platforms | — | meters your events | — | you define it |
| Build it yourself | ≈ 6 months | ≈ 6 months | if you get it right | eventually |
| tack | the product | atomic ledger + wallet | by construction | the turn |
Every AI SaaS rebuilds the same subsystems before it can send its first invoice. None of them are your product. They are runway burned before go-to-market.
| Subsystem | Build yourself¹ | On tack |
|---|---|---|
| Metering + usage ledger | 4 wk | included |
| Prepaid wallets, top-ups, billing reconciliation | 5 wk | included |
| Tenant isolation: rows, caches, queues | 3 wk | included |
| Permissions for AI: clearance, channel ceilings | 3 wk | included |
| Tool safety: timeouts, confirmations, idempotency | 3 wk | included |
| Audit trail + trace explorer | 3 wk | included |
| Cost control: caps, kill switches, fair-use envelopes | 2 wk | included |
| Runway spent before your first invoice | ≈ 6 months | day one |
1 Typical single-engineer estimates for a production-grade version, not a demo. Your mileage varies; the total doesn't shrink much.
tack wasn't built to be sold: it was extracted from a SaaS that needed all of it in production. The strongest proof it generalizes came next — an agency running client builds on it.
minuit
Ships AI features for client products on one engine: a project per client, tenants per their customers, wallets keeping every client's spend separate and capped. The client invoices on turns; the agency keeps the spread and carries no on-call for the engine.
synoveo
Guest-facing and back-office AI for lodging businesses. Every property is a tenant; every reply, booking action and escalation runs as a metered turn with a full audit trail.
The wallet is checked before the turn; the usage row and the debit commit together. Usage rolls up per tenant, so you know what a customer costs before you price them.
Two things, priced separately. Every paid plan pays the same $0.06 standard turn: volume never buys a discount. Metered has no monthly fee and prices the turn at 2× instead: zero fixed cost until a plan pays for itself.
Project: one product you ship, with its own keys, tools, knowledge and clearance. Tenant: one of your customers inside it, isolated, with its own usage line. Metered is one product serving up to 25 customers.
Start on Metered with no fee at all — you pay only on turns you are already billing your own customers for. Launch pays for itself past roughly 4,150 standard turns a month. Extra projects are $99 each per month.
Self-host is for teams who want to own the runtime: your infrastructure, your keys, your continuity plan, the same engine. Annual, with a real number on the first call.
| Turn class | Shape | Metered | On a plan¹ |
|---|---|---|---|
| Light | fast model, no tool loop | $0.016 | $0.008 |
| Standard | tool loop + guards | $0.12 | $0.06 |
| Heavy | agentic, long context | $0.60 | $0.30 |
1 The same unit price on every paid plan — Launch, Scale and Business differ in what they include, never in what a turn costs. Turns are prepaid to a wallet and drawn down as they run; nothing is invoiced in arrears. The price buys the run itself: the wallet gate, clearance, guards, tool contracts, and the audited ledger row each turn commits with. A fair-use envelope bounds each class. Rates are reviewed quarterly, any class change gets 30 days' notice, and balances you have already bought are honoured at the price you bought them. No free tier, 14-day money-back. tack never spends money it hasn't collected.
Create a tenant. Submit a turn. Everything else was already running.
Pre-launch. The prices above are the real prices; keys go out to the waitlist first. Blocked by a security review? Say so: the threat model, DPA and sub-processor list go out by reply. We only use your email to notify you — see the privacy policy.
