Isolation you can demonstrate
A key from one client gets a 404 on another client's execution — not a 403, so the response does not even confirm the record exists. Tenancy is filtered in the query, not remembered by a developer.
One organisation per client, each with its own policy, budget and models — plus one screen across all of them, a statement per client, and a read-only login you can hand the client themselves.
An agency running AI automations for a dozen clients ends up with a dozen provider keys, one blended invoice, and no way to answer “what did we spend on you, and what were you never allowed to do?” without a spreadsheet and a guess.
A key from one client gets a 404 on another client's execution — not a 403, so the response does not even confirm the record exists. Tenancy is filtered in the query, not remembered by a developer.
Executions, provider cost and the billable figure for each organisation you belong to, side by side, with one click to switch into any of them. A client whose figures fail to load is shown as unavailable and excluded from the totals — never counted as zero.
One line per client for a period, exportable. The billable figure is separated from provider cost on purpose: usage funded by the client's own provider key was already billed to them directly, and charging it again would be double billing.
Provision a new client organisation from one you already run — policies, pools and environments copied, a project and a key ready to hand over. Each clone starts its own version lineage, so a policy version number never means two different things.
The viewer role reads spend, executions and refusals and can do nothing else: it cannot spend, cannot change a policy, and cannot see who else is in the organisation. Roles are enforced at the gateway, so hiding a control is a courtesy rather than the mechanism.
Point an n8n AI node at the gateway and its MCP tools arrive unclassified — a class no policy grants — so a freshly discovered catalogue is exposed to nothing until you classify it. Measured on a 60-tool catalogue: 798 forbidden exposures with no gateway, zero with one.
Adding a client to their own organisation works by email, but only if they already have a Planverity account — invitations to an address that has never registered are not built, because that would put an unverified email in an access-control table. There is also no white-labelling: the console your client signs into says Planverity.