Three dials — workspaces for collaboration, agent-hours for missions, and production hosting. Spend caps are hard limits in the control plane, never in an agent prompt, so a runaway mission stops at the wall you set. Credit packs ($20 / $100 / $500) are the pay-as-you-go path.

Yes — connect your own keys via OAuth (free) and run on your provider, or use metered platform inference as the convenience path. Your call, per workspace.

Every tenant gets its own control-plane boundary. Agents never see raw long-lived credentials — scoped short-lived tokens are injected per mission, and egress is gated by a per-tenant allowlist.

One micro-credit balance across every primitive the workspace touches — LLM calls, browser minutes, email sends, payments, storage. Every primitive call flows through the control plane and is checked against the wallet cap + per-agent cap at the boundary. Over-cap calls block until a human approves; the agent cannot raise its own caps. The portal surface at /account/billing/credits shows the live balance, per-agent caps, and recent activity as a tail of the audit log.

Team is $49 per seat per month for collaborative workspaces and production hosting. Agent Box is $19 per month for a persistent agent that survives between sessions and pairs with any workspace tier.

Yes — Enterprise & Agency runs as a dedicated cluster in your cloud, or fully self-hosted on-prem with an air-gap-capable Helm installer. One codebase, deployment-shape-agnostic.

The substrate decision lets us undercut the indie price floor and still hold a healthy margin. Per-tenant idle cost on Hetzner + E2B is ~$0.04/mo vs $10–30/mo on the AWS path — a ~200x advantage. The substrate is documented in the canonical vault, the override is dated, the deploy scripts enforce it, and the guard script rejects re-introduction. This is a unit-economics moat, not a cost decision.