The questions careful buyers ask

At the live stage, yes, and only then. The gateway speaks the OpenAI-compatible API, so the change is base_url= plus two headers. The free quote never touches your traffic, and the canary stage makes this same change on staging or a slice of traffic first. Second Moment forwards each call to the real provider, substituting the specific model only within the tier your spec declares.

In live mode, Second Moment's, deliberately. You pay the fixed per-unit price, Second Moment pays the providers, and the difference is Second Moment's margin or loss. The key swap is the risk transfer: on your own keys you'd still be carrying the cost variance and Second Moment would just be a meter. During a pass-through canary the gateway is on the path but you are billed actual cost, so the key swap starts before the risk transfer does.

Second Moment fails open. If the gateway is unreachable, the client falls back to calling the provider directly on escrowed keys, and usage reconciles after the fact. Enforcement lapses during the outage, but the party exposed to unenforced spending is Second Moment, not you: your price is fixed either way. A cost control can't fail open (you'd eat the overrun). A cost underwriter can, because the tail lands on our book. Your agent never goes down because Second Moment did.

Mapping is just the header: every call stamped x-sm-unit: tkt_1042 belongs to that unit: your own id, first use opens the unit, close (or timeout) ends it. Context stays where it lives today: LLM APIs are stateless, and your code or framework accumulates the messages between turns. Second Moment forwards the request body untouched and never stores or injects context. The same goes for retrieval: your code queries your own docs or knowledge base and assembles the prompt exactly as today, and that context reaches the model inside the request body. Tool calls execute in your code, behind your own wall, with the gateway only counting the round-trips. That's also why tier substitution is safe mid-unit (full context arrives with every call). One subtlety we handle deliberately: routing is sticky within a unit, so re-sent context keeps hitting the provider's prompt cache. Hopping models mid-unit would forfeit cache discounts, and that cost would land on Second Moment's own margin, which is exactly the right incentive.

A passthrough hop adds single-digit milliseconds against calls measured in seconds, the same pattern every AI gateway has normalized. Prompts transit Second Moment's infrastructure under the trace contract: retained for pricing and audit (that's what receipts and renewals are built on), no other use, with regional deployment and BYO-cloud on the enterprise path.

Code is the one thing Second Moment never needs: the gateway meters every LLM call (tokens, tools, iterations, terminal states, priced at call time), which is 100% of the billable behavior. Three consequences. Your quote is priced on your own measured distribution, with the archetype prior filling in only where your data is thin, and thin data means a capped or declined first contract, so the label matters least where it could be gamed most. The cost envelope your spec declares never reads the archetype at all: a mislabeled workload still can't spend past its bound. And the declared archetype is a statistical claim your own traffic tests continuously. Research-agent traces don't look like ticket traces for even a week, so contracts treat it as a warranty: divergence triggers reclassification and requote. Classical insurers can't watch you drive. This one meters every mile.

No. There is no pre-launch gate: the contract prices unit types on your book, not your roadmap. A new feature launches at pass-through (actual cost, exactly as today) or inside your existing cap from day one, and because the gateway is already on your call path, its cost distribution accrues from live traffic with no new integration. Around 100–200 real units in, a quote for the new unit type generates from its own data. Accept it and the feature graduates to a fixed price, or leave it at pass-through. Even unpriced, the feature ships with a spec, so its worst case is computed and enforced from the first run. Requoting after a spec change (a new tool, a new prompt, a model swap) is a computation on data we already hold, not a sales cycle.

In three steps that shrink a band into a number. Day zero: the spec alone gives the worst case, and the archetype prior gives an indicative cost band. A band plus an enforced ceiling is enough to test whether your intended customer price clears cost with margin. Before GA: beta and design-partner traffic through the gateway is already calibration, so launch pricing is set against measured beta economics rather than a projection. At roughly 150 production units, the band hardens into a signed fixed price. And the provably-safe fallback needs no data at all: price above the spec's enforced worst case plus your margin, then lower it once calibrated, which is the direction of repricing customers forgive.