Allowances without surveillance. Routing without a leap of faith.

Personal-use allowances — without reading a single query

Enterprises increasingly want to grant employees a defined slice of AI usage for personal or exploratory work. The obvious implementation — classifying each query as business or personal — requires reading content, and guesses wrong often enough to become surveillance with errors. We refuse that design.

Instead: the enterprise declares lanes — business and personal — and each person receives a percentage of the period budget on each. People select the lane themselves; enforcement is quantity-only and exact by construction. Excess is granted through an approver workflow using reason codes, never free text, so even the grant ledger carries no content. Every allowance, grant, and lane total seals into the attested statement.

Each person watches their own meter — nobody watches them

Every employee can see a live countdown of their own allowance: used, granted, remaining, and when the period resets. A visible gauge makes over-use self-correcting — a gas gauge, not a speed trap — and a granted extension visibly raises it, so the allowance reads as the benefit it is.

In the ordinary course, the organization sees lane totals only, with a minimum-group-size floor — a statement reporting any group below the floor fails verification outright.

Exception review that is itself on the record

Individual counters are sealed — encrypted at rest, invisible to everyone including the employer. The only key that opens one is a published, quantity-only criterion firing (sustained volume far above the lane median, off-hours concentration, endpoint fanout), followed by dual approval from two different roles. The opening itself is a ledgered, attested event the affected person can later see. No fishing, no discretion, no quiet looks.

Multi-contract efficiency, at the involvement you choose

When an enterprise holds several AI contracts, the cheapest eligible provider for a task class is a fact of arithmetic — against your own rate table, hash-pinned so it cannot drift. Four rungs, each with attested output; you climb only as far as you want:

The rate table is the pinned rate card: the per-model prices in force at go-live, sealed into the ledger with its hash recorded. Every savings statement names the pin date and the card hash. If the card is re-pinned — a provider change, a renegotiation — the superseded card is retained and remains verifiable, and no period is ever recomputed at a later card. Provider price movement is disclosed on its own line and is never billable.

Authority is proven, not asserted

Some actions are too consequential to run on someone’s say-so — moving funds, reaching outside a declared boundary, or, for an agent, exercising a high-impact tool. For those, an agent under TokenMark™ does not accept a claim of authorization. It requires a signed engagement record from the affected party’s own domain: a statement, signed by a key that belongs to the environment being acted upon, that says what is permitted, until when, and where. An operator typing “this is an authorized test” supplies no such thing, and the action is refused — on the record. No party can authorize itself, and no party can authorize an environment whose key it does not hold. The mechanism detail is held under AW-SEC-001 (NDA).

Suspension that fits the fault

When a credential misbehaves — a hijacked session, an agent past its allowance, a key seen where it should not be — the suspension is scoped to that one credential, and to nothing else. It fires on a declared criterion, not on someone’s judgment call; it is lifted only under dual control; and every attempt to lift it, granted or refused, lands on the same chained record as everything else. Nobody else loses their session, and the enterprise does not learn about the fault from a company-wide forced logout. The account-wide remedy still exists — behind break-glass, where a remedy that blunt belongs.

Before and after the first call

An agent is the first thing in the stack that spends without a person in the loop. TokenMark™ seals the control set before its first call, and the outcome after — both recomputable by your auditor, neither requiring the content.

Stated plainly: on counts alone a scheduled job and an agent look alike. TokenMark™ attests a declaration and a signature, and reports when they disagree. It does not attest intent and does not read content. The argument in full: Writing No. 5, Before and After.