The customer gets the model you priced for, not the one they picked

Your product lets customers ask questions; the model behind it is yours to choose. Starter-plan customers keep editing the model field to the expensive one.

Customer containers are created with ai: false. The only route to a model is your proxy container, where a catch-all hoody-exec script authenticates to the gateway as itself. The script reads each request, looks up the customer by metadata.parameters.tenant, rewrites req.body.model to the plan's default when the requested one isn't on the allow-list, and returns 429 once the day's token count is spent.

There is no provider key in the customer's container to route around this, and no gateway identity either. The proxy is the model, as far as their code can tell.

The allow-list lives where the customer's code can't reach it.