Every client's AI, on one set of keys

On a Tuesday morning a consulting principal presents an AI governance roadmap to a client’s executive team. Twelve slides on approval workflows, model selection criteria, and audit readiness. The client signs. That afternoon, back at his own office, four of his engineers are running coding agents against three different clients’ repositories, on a mix of personal API keys and one shared team plan, billed to a single company card. Nobody in the building could say which client’s code went to which model that week, or what any of it cost.

That gap is common, and it shows up in well-run firms. Systems integrators and AI consultancies picked up orchestration and spend management for large companies quickly, because clients asked and somebody had to do it. The controls came second. Most of the AI a services firm runs today lives inside individual tools, on individual keys, with the record of what happened stored wherever each tool decided to put it.

Two problems that grow with the practice

The nature of the work sharpens the first one. A consultant’s agents read client material all day: tickets, documents, repositories, support threads, vendor email. All of it is untrusted text, and some of it can carry instructions. Prompt injection is the attack where hidden instructions redirect an agent into doing something its operator never asked for, and it sits at LLM01 on the OWASP Top 10 for LLM applications, first on the list. An agent working through a client’s inbox is precisely the surface that entry describes. A firm holding material from a dozen clients on one set of credentials has concentrated that exposure rather than spread it.

The second problem arrives at month end. When a firm consumes AI on a client’s behalf, it eventually invoices a number. The provider console that produced that number has no concept of a client, a matter, or an engagement, so the firm either absorbs the cost quietly or reconstructs an explanation by hand from exports. A client asking what eighteen thousand dollars bought is asking a fair question. The honest answer is often that nobody can reconstruct it line by line, which is an uncomfortable position for a firm whose product is judgment about other people’s systems.

Both problems point at one absence. A firm running AI on other people’s behalf needs a control point in the request path. One place every model call passes through, where input is screened before it reaches a model, spend is capped before it runs away, usage is attributed to the client it belongs to, and the sequence is written to a record that outlives the tool that produced it. That layer has to sit outside the model and outside the tool, because both change every few months while client obligations do not.

What the layer does

Constellation Gate AI is that control point. It sits inline between an agent and the model providers, and it is available today on a free tier, a per-seat subscription, and pay-as-you-go access across more than three hundred models (pricing). Existing tools and subscriptions keep working, so a team’s coding agents carry on billing the way they already do.

Rocket Resume shows what changes. It is a high-traffic resume builder where nearly every session calls a model, running roughly 150,000 visits a month against about $40,000 a month in token spend. They routed that workload through Gate without altering application code. Caching and compression cut the token cost by 23 percent, and the figure was checked against their own provider invoices rather than read off our dashboard (case study). Savings of that kind run 20 percent or more per request, though results vary by workload.

The part their team valued more was visibility. Version control shows commits, not consumption, so nobody could say which engineer or which product was spending what. The audit trail answered that, and Rocket Resume went on to build an internal program that rewards engineers for effective AI use. Efficiency stopped being a rule imposed from above.

On the way in, every request is screened for injection attempts. Our engineering team published the methodology behind that detection across 16 public benchmarks and 12,111 samples, using a single global threshold rather than one tuned per dataset. At a strict one-in-a-hundred false-alarm cap it catches roughly 95 of every 100 injection attempts, with a median added latency of 53 milliseconds (report and methodology). Screening reduces this class of risk without removing it. What Gate controls is data exposure to untrusted models, meaning the client material, personal data, and credentials moving through prompts and tool calls. How a model behaves once it has a clean request is a different problem with different answers.

On the way out, responses can be redacted for personal data and credentials before they return, and spend, token, and rate limits can be set per organization, project, or key, so a looping agent stops at a number the firm chose instead of at the credit card limit. Every request also emits an audit event, hash-chained and anchored to Constellation’s Digital Evidence layer, which means the record can be checked by a party other than us. That distinction matters in this business. A firm that keeps its own logs is asking a client to trust the party being audited, and an auditor will say so.

The part that changes the engagement

Running this internally is worth doing on its own merits. For a services firm the more interesting move comes next.

Under our reseller program a firm provisions client organizations inside Gate, bills those clients directly through managed billing, and keeps the commercial relationship it already owns. It earns margin on the subscriptions and on the managed token usage it resells, and there is no minimum commitment to sign up to. The subscription margin is weighted toward a client’s first year rather than running in perpetuity, which is worth knowing before anyone builds a forecast on it. The durable asset is the engagement itself. A firm that administers a client’s AI layer, reports on it monthly, and can produce a verifiable record on request is considerably harder to displace at renewal than a firm that delivered a roadmap and left.

There is also a clock worth planning around. The record-keeping obligations for high-risk AI systems under Article 12 of the EU AI Act come into force on 2 December 2027 for systems listed in Annex III, and 2 August 2028 for those covered by Annex I. Clients in scope will be asked how their AI activity is logged long before those dates, usually in a procurement questionnaire or an internal audit rather than on the deadline itself. A firm that already runs the answer, for itself and for its clients, is selling something a slide cannot.

The consultancies that end up owning this work will be the ones that put the layer in front of their own agents first, and can say so without hedging. Point your own traffic at Gate, watch a week of it, and you will know exactly what you are recommending. Injection screening, secret redaction, spend caps, and a tamper-evident record, in front of every agent you and your clients run. Free to start.