Under every AI product there is hard, boring work: keeping customers apart, collecting money before the model spends it, deciding what the AI may do, and writing every step down. tack is that part, already built. You write the tools and screens that make your product yours.
For builders who charge money.
A ship's log is the record that holds up afterwards. tack keeps one for your AI: usage and money, committed together. Both or neither.
From your own signup code. Idempotent: retries can't fork a customer.
Stream the reply over plain SSE. Tools call back into your codebase, signed.
Usage rolls up per tenant. Price your product per turn: the spread is your margin.
Enforced in the schema and the type system, not asserted in comments. When a customer disputes a bill, "trust us" is not an answer.
| ID | Guarantee | Mechanism |
|---|---|---|
| MTR-01 | A turn that can't pay never runs | Prepaid wallet checked before every turn; hard cap; the usage row and the wallet debit commit in one transaction. Refusals cost 0 and are audited. |
| ISO-01 | Tenants cannot see each other | org → project → tenant from migration 0001. Every row, Redis key, queue job and trace carries the tuple; a foreign tenant id is a 404. |
| CLR-01 | Access fails closed | Your backend asserts what a user earned; tack computes min(ceiling, earned) once per turn. Unknown rung → ladder floor. |
| TOOL-01 | A broken tool degrades a turn, never kills it | Per-tool timeout resolves to an error envelope; the model works around it. Repeated failure raises tool_degraded: failure is routed, not accidental. |
| AUD-01 | Every AI decision is reconstructible | Span tree per turn, tool inputs/results, clearance verdict, cost by trace id. Cost is read from the ledger, never recomputed. |
Boring technology, arranged carefully. No exotic databases, no bespoke protocols: parts your team already knows how to operate.
Prompt injection is assumed, not hoped away. Controls map to MITRE ATLAS; the adversarial suite replays these classes, against the money path and across tenants, as a release gate.
| ATLAS | Technique | Control |
|---|---|---|
| AML.T0051 | LLM Prompt Injection | Injected instructions can only ask for what the turn could already see: context is clearance-gated before injection, retrieval is tenant-keyed before ranking, a pre-emit guard screens output. Denial by structural absence. |
| AML.T0054 | LLM Jailbreak | Guardrails are semantic judges, not regex lists, running pre-emit inside the stream. Abuse ceilings brake repeat probing. |
| AML.T0057 | LLM Data Leakage | Your sensitivity vocabulary maps to retrieval floors; the reserved never class is structurally unretrievable; redacted fields are stripped before model, storage, webhooks. |
| AML.T0086 | Exfiltration via Agent Tool Invocation | Tools are clearance-gated per turn; tenant identity and the verdict ride the signed server envelope, never the model-visible schema. |
| AML.T0034 | Cost Harvesting | Prepaid wallets, hard caps, fair-use envelopes, per-tenant kill switch. The bill cannot be weaponized. |
| AML.T0029 | Denial of AI Service | Per-tenant concurrency slots, fair scheduling: a hot tenant deepens its own queue, never a neighbor's. |
Full threat model, DPA and disclosure policy → security
Gateways proxy calls. Frameworks structure code. Billing platforms meter events you define. None will run your customer's turn, refuse it when the wallet is empty, and hand you a unit to invoice. The business engine is a new category.
| Runs the turn | Keeps the books | Isolates tenants | Unit you can bill on | |
|---|---|---|---|---|
| Model gateways | proxies calls | per-key budgets | — | tokens |
| Agent frameworks | in your code | — | — | — |
| Usage-billing platforms | — | meters your events | — | you define it |
| Build it yourself | ≈ 6 months | ≈ 6 months | if you get it right | eventually |
| tack | the product | atomic ledger + wallet | by construction | the turn |
Every AI SaaS rebuilds the same subsystems before it can send its first invoice. None of them are your product. They are runway burned before go-to-market.
| Subsystem | Build yourself¹ | On tack |
|---|---|---|
| Metering + usage ledger | 4 wk | included |
| Prepaid wallets, top-ups, billing reconciliation | 5 wk | included |
| Tenant isolation: rows, caches, queues | 3 wk | included |
| Permissions for AI: clearance, channel ceilings | 3 wk | included |
| Tool safety: timeouts, confirmations, idempotency | 3 wk | included |
| Audit trail + trace explorer | 3 wk | included |
| Cost control: caps, kill switches, fair-use envelopes | 2 wk | included |
| Runway spent before your first invoice | ≈ 6 months | day one |
1 Typical single-engineer estimates for a production-grade version, not a demo. Your mileage varies; the total doesn't shrink much.
tack wasn't built to be sold. It was extracted from a SaaS that needed all of it in production. Then a second business put it to work.
synoveo
Guest-facing and back-office AI for lodging businesses. Every property is a tenant; every reply, booking action and escalation runs as a metered turn with a full audit trail.
minuit
Ships AI features for client products on one engine — a project per client, tenants per their customers, wallets keeping every client's spend separate and capped.
One turn = one submitted message → one completed agent response, everything under its trace id included. You price your own product per turn too: this table is your cost line, and the spread is your margin.
| Tier | Monthly | Projects | Tenants | Turns¹ |
|---|---|---|---|---|
| Launch | $199 | 1 | 100 | ~3,000 |
| Scale | $599 | 5 | 1,000 | ~12,000 |
| Business | $1,999 | ∞ | ∞ | ~45,000 |
| Turn class | Shape | Rate² |
|---|---|---|
| Light | fast model, no tool loop | $0.008 |
| Standard | tool loop + guards | $0.06 |
| Heavy | agentic, long context | $0.30 |
1 Allowances meter in standard-turn equivalents; mixed workloads burn by class at published ratios. 2 Rates set from measured production cost distributions at a fixed margin; a fair-use envelope bounds each class. No free tier. 14-day money-back. tack never spends money it hasn't collected.
Create a tenant. Submit a turn. Everything else was already running.
