Metering
Every model call runs through one transport and one metering decorator, with a source-scanning boundary test failing the build on a direct call site - see The invocation contour. A limit is worth what the least-instrumented path around it is worth, so the absence of that path is enforced, not assumed.
- An organisation's own provider key is not metered by the platform. Metering no-ops when the resolved provider is not the platform's.
- Billing is idempotent per attempt. Each attempt derives a fresh request id, so a retried call bills once. Against the credit engine's replay rule, a constant request id unbills rather than double-bills.
Per-employee budgets
Beyond organisation-level credits, an individual AI employee - a specific assignment to a specific position - carries its own monthly budget:
| Property | Behaviour |
|---|---|
| Limit | Hard, per assignment, per month |
| No budget set | Over limit. A newly hired employee is refused until a limit is set. |
| Period rollover | Lazy - evaluated on read, so no scheduled job is required |
| Suspension | A state with a reason, surfaced on the roster beside limit and spend |
| Exhaustion | Refuses. It does not fall back to a service identity. |
The last row is the one that decides whether the rest is real: a budget exhausted between retries refuses under the employee's own identity instead of continuing under an unlimited one. A test pins that behaviour.
Spend accrues against the assignment on both paths a digital employee runs on - the workflow activity and the execution bridge - so cost attributes to the employee, not only to the organisation.
Cost per staffing unit
Settled spend, summed by month for a given assignment, on the employee's work card beside the limit and the suspension state. It is drawn from the same credit ledger the holds settle against.
Rate limits
Separate from money, per dimension: chat requests per IP and per user, MCP requests per IP, analysis requests per user, message size, rows returned per call, tool-calling rounds per turn, session history length with a TTL.
The tool-call round cap bounds spend within a single turn independently of the budget.