Ekam blog · 7 July 2026
Identity and billing in one plane: metering agents by the owner
Ask an agent-identity product two questions. "Who is this agent, and may it do this?" — every one of them answers. "What did it cost, and who pays?" — none of them do. That gap is not an accident: identity vendors don't sit on the inference path, and the AI gateways that meter tokens don't issue identity. Ekam closes it by being both.
The two halves nobody joins
On one side: agent-identity platforms — they broker credentials, enforce scope, revoke tokens. They have no idea what an agent spent, because a model call never passes through them. On the other side: AI gateways — they meter tokens beautifully, but they authenticate with a shared virtual key, so "who spent this" is a label a human typed, not a verified identity. The result is that cost and identity are tracked in two different systems that don't agree.
One token, two jobs
An Ekam token is issued by the identity plane and verified by the inference gateway (BharatRouter). So the same credential that proves an agent's identity is the one the gateway meters against:
agent ──token──▶ gateway.verify(jwt) // who: agt_… acting for own_… for hum_…
├─ enforce scope + budget // may it? how much is left?
├─ call the model
└─ meter usage ─▶ attribute to the OWNER (act.sub), by cost_center
└─ (when charging is on) bill that ownerNo reconciliation, no guessing. The identity is the billing key. Usage rolls up per agent, per owner, and — because Ekam carries a cost_center claim — straight into finance's cost model.
Down a delegation chain
It gets more useful when agents call agents. A planner agent fans work out to workers; each sub-agent's token carries the chain sub-agent → planner → owner → human. Because the owner rides the whole chain, the spend of every sub-agent lands on the human who set the work in motion — even three hops down. You get per-hop attribution and a single, honest bill, instead of orphaned cost under a service account nobody owns.
Why this is the durable part
The mechanics of agent identity — short-lived tokens, scopes, kill-switches — are converging across the whole industry; they're becoming table-stakes. What isn't converging is the fusion of identity with metering and billing: it requires owning both the credential and the inference path, which almost no one does. That's the piece we think is worth building around — because "give your agents an identity" is quickly becoming a commodity, and "give your agents an identity and a per-owner bill" is not.
Safe by construction
Metering runs append-only and is turned on well before charging is: the bridge starts in meter-not-charge mode, so usage is measured and attributed but not billed until an owner is funded. Identity ships first; money moves later, deliberately. And none of it touches the request hot path — the gateway verifies offline and meters locally.
See the gateway integration For developer platforms Docs