AI is a paid tier, and the tier is a boolean

Each customer of your SaaS gets a container. Pro customers get the AI assistant; free customers don't.

There's no feature flag in your code for this. AI access is a property of the container: container-customer-acme has ai: true, container-customer-startup has ai: false. Upgrade is one PATCH /api/v1/containers/{id}. Downgrade is the same call with false. Churn is DELETE, and the identity goes with it.

The customer's code runs in their container and calls the gateway as that container. There is no per-customer provider key to provision, no key to revoke when they leave, no shared key a curious customer could extract and spend on behalf of the others.