Cost governance & safety

On cost: a built-in price table for 17 models, task-level routing that sends light work like email classification to the cheapest model, and full cost instrumentation across 23 task types. The monthly budget is a hard ceiling — at the line, model calls are refused. Not a warning; a brake. Usage slices by model, task, user and run, with a most-expensive-conversations ranking.

On safety: six roles — five customer-side tiers from read-only to admin, topped by a vendor tech tier: API keys, model configuration, tenant customization and maintenance endpoints belong to the vendor alone, so the customer admin stays focused on the business itself (users, teams, publish confirmations). Every endpoint enforces a minimum role by path and method; sales reps see only their own assigned inquiries; every write operation suspends for admin confirmation, backed by an anti-hallucination protocol — the AI may not declare success or invent links while an action is pending.