Billing and Credits

FaburAI's billing model is credit-based and metered per governance event, not per seat or per API call. Every governed request is recorded as a usage event with a stable meter code (for example runtime.policy_evaluation.standard or runtime.policy_evaluation.complex), and the launch price book — versioned as launch-2026-08 — translates those events into credits using a per-meter conversion rate.

Event capture happens on the data plane in data-plane/modules/metering, which implements the Local Usage Journal: an append-only, idempotent record of billable activity that is deliberately kept separate from gcdm_invocations and gcdm_decision_logs (those exist for governance and audit; metering has its own lifecycle so a billing outage can never lose an audit row, and vice versa). The Journal writes into gcdm_usage_events, and a per-hour Usage Aggregator rolls those events into gcdm_usage_rollups bucketed by meter and hour — that rollup table is what the Metering & Billing tab in AI Cockpit reads. There is also a manual POST /api/dp/v1/metering/rollup for on-demand aggregation, mostly used in test and demo settings where you don't want to wait for the hourly tick.

Rating — the translation from quantities into credits owed — lives in the control plane, in control-plane/modules/billing. This split is intentional: the data plane's estimate is what you see in-product for a locally-connected tenant, but the control plane's price book is the authority on what's actually billable. The launch catalog has 10 live meters covering runtime governance (policy evaluations), asset counts (active MCP servers, actors, data sources, policies), and jobs (discovery scans, drift checks), plus three reserved meters (approval workflow, AI assist, gateway dry-run) that rate to zero today so early customers see them accounted for even if we haven't turned them on yet.

Every rated row carries the price-book version it was rated under, so introducing per-tenant contracted price books later — with different rates, effective dates, or waivers — will never silently re-rate history. All money math is NUMERIC(24,6) for exact decimal precision, and the dedupe path uses the invocation ID as the idempotency key so a retried batch never double-counts.

The cross-tenant staff console at the control plane's /usage route lets Platform Operations see rollups across the fleet; tenant-side users see their own consumption in the AI Cockpit's Metering & Billing tab. On trial tenants the tab is hidden (there is no billable meter under a trial) — that gating lives in the Cockpit UI layer, per decision D-5.6.