The Ghost in the Metering Layer: Enterprise AI Pricing and the Private Currency Problem

Look at the spread first. Microsoft publishes a credit at $0.008. Salesforce publishes a credit at $0.005. That is a 60% gap on a unit that both vendors insist is the same thing — a fungible measure of machine labor — and not one procurement officer in the world can arbitrage it. You cannot buy Microsoft credits and spend them on Salesforce. You cannot convert them. You cannot even compare them, because the two companies refuse to define how many credits a business action actually burns on the other's platform. Following the ghost in the side-channel shadows here is not a metaphor. The side channel is the rate card, and the ghost is the definition that nobody published. This is the quiet event that the enterprise software market has spent eighteen months pretending is a communications problem. It is not. When eight platforms converge on consumption-based billing for autonomous agents and four of them refuse to publish any enterprise price at all, while the remaining four publish units that are mutually incommensurable — seats, credits, actions, tokens, conversations — you are not looking at a gap in marketing transparency. You are looking at the moment a new unit of account is being minted by private parties, with no standards body, no audit trail, and no disclosure obligation on the debasement schedule. That is a monetary event dressed as a pricing page. And the people who will absorb the cost are the ones currently filling out next year's budget template with a number they invented. The arithmetic is the tell. Meta's WhatsApp reply pricing is the rare published anchor: $2.00 per million tokens, which the vendor describes as roughly four to five cents per message. Divide. Four to five cents against two dollars per million tokens implies each "message" consumes somewhere between 20,000 and 25,000 tokens. A consumer chat turn is 500 to 2,000 tokens. An agent turn is ten to fifty times larger, because the context window swallows the system prompt, the tool definitions, the entire conversation history, the retrieval results, and every tool return, and then re-bills all of it on the next hop. That single ratio — one order of magnitude, with variance that is itself an order of magnitude — is the technical fact from which the entire pricing crisis descends. Let me be precise about the mechanism, because the industry keeps describing it as a business-model shift when it is closer to a physics problem. A seat is a stable unit. It counts a human, once, for a month. Its cost is predictable to within the accuracy of a headcount spreadsheet. A token is a stochastic unit. It counts the residue of a reasoning process whose length depends on how hard the task was, how verbose the retrieval layer is, how many tools the orchestrator decided to call, and how many times the agent looped before it decided it was done. Seat-based billing worked for thirty years because the denominator — the human — did not fluctuate intraday. Agent billing broke because the numerator does. You cannot bill a fixed price per seat for a workload whose cost per seat varies by a factor of ten depending on what the customer asked it to do on a Tuesday. The vendors know this. Microsoft said it out loud when it retired the old "25,000 messages for $200" construct: consumption depends on how the agent is designed and used, and a message no longer corresponds to a fixed price. Read that sentence again, because it is a concession, not a marketing line. The vendor is admitting that the same nominal unit — one message — can consume wildly different resources across two customers with identical seat counts. The moment a supplier concedes that its unit of sale is not stable, it has conceded that it cannot publish a stable price. Opacity is downstream of that concession. It is not a strategy layered on top of a working model; it is what remains after the model stopped working. I have watched this exact failure mode before, from the inside. In 2017 I spent 120 hours auditing the Groth16 proof verification logic in a privacy protocol, hunting for edge cases in the circuit constraints that could desynchronize node behavior. What I learned there has followed me through every market cycle since: the most consequential vulnerabilities are never in the headline primitive. They live in the boundary conditions, in the places where two systems with different assumptions are forced to agree on a shared representation. The circuit was fine. The constraint edges were not. Enterprise AI pricing is in that same boundary condition right now. The primitive — a model that does work — is fine. The shared representation — a unit that both buyer and seller can price against — does not exist yet, and both sides are pretending it does while signing contracts that will be reconciled by lawyers. So let me map the terrain honestly, because the numbers are circulating and the structural logic is verifiable even where the specific figures are not. Salesforce's Agentforce publishes a $5 per-user license, add-on tiers at $125 and $150, a $50 coworker construct, and a Max Edition starting at $550, against a consumption rate of $500 per 100,000 Flex Credits — five-tenths of a cent per credit — with twenty credits burned per action. That is ten cents per action, and an action is defined by the vendor, not the buyer. Anthropic's enterprise tier publishes $20 per seat per month on annual commit, with chat, Claude Code, and coworker usage billed separately at standard API rates. Microsoft's Copilot Studio publishes $200 per 25,000 credits — eight-tenths of a cent per credit — with no seat concept at all. Microsoft 365 Copilot, in the change now rolling through the channel, defaults to usage-based billing with a default ceiling of 4,000 credits per user per month. Meta gives away the entry tier and charges $2.00 per million tokens on replies. xAI publishes an API card at $2 and $6 per million tokens while declining to publish enterprise rates. Google's Gemini Enterprise and ServiceNow publish nothing verifiable; the third-party figures of $21 to $60 per seat and $70 to $200-plus per fulfiller are precisely that, third-party, and the wider the range, the more it tells you the price is bespoke. The first instinct of a procurement analyst is to normalize. Convert everything to cost per action, or cost per resolved ticket, or cost per thousand tokens, and compare. That instinct is correct and it will fail, and the reason it will fail is worth more than any single number in this article. The credits are not comparable because the credit is not a unit. It is a currency. And the issuing authority retains, in every published rate card I have seen, the unilateral right to change the conversion rate between the currency and the underlying work. Eight-tenths of a cent per credit means nothing if the vendor can decide tomorrow that a refund action costs thirty credits instead of twenty. Where liquidity narratives fracture and reform — and I have watched them fracture in DeFi, in staking derivatives, in every corner of this market — the fracture always happens at the point where the nominal unit and the real resource stop tracking each other. Here the nominal unit is the credit and the real resource is inference compute, and the tracking between them is a vendor-side configuration file. Auditing the fragility of synthetic stability is the discipline this moment demands. A credit system is synthetic stability. It looks like a currency, it spends like a currency, and it has three properties that would get it laughed out of any serious monetary design review. First, the issuer can debase it by changing the burn rate per action without changing the sticker price, which is a stealth price increase that will never appear in a procurement report. Second, it is non-convertible and non-transferable, so there is no arbitrage and therefore no market discipline on the issuer. Third, there is no disclosure obligation — no inflation report, no supply schedule, no independent audit of how many credits a given action actually consumed. This is the airline-mile model with worse governance and higher stakes. Airline miles devalue on a published schedule, roughly annually, with press coverage. Enterprise AI credits will devalue in a partner-center announcement on a Friday, and the only people who will notice are the finance teams reconciling a variance in Q1. The most substantive risk in the entire dataset, though, is not a number. It is a default setting. Microsoft's channel change makes usage-based billing the default for new Copilot Business subscriptions through the cloud solution provider channel — opt-out, not opt-in — with the United States not on the exclusion list, and a default ceiling of 4,000 credits per user per month. Microsoft's own worked example is a hundred users capped at 400,000 credits monthly. Run the Copilot Studio rate against that as an upper-bound estimate, with the caveat that cross-product credit rates are almost certainly not interchangeable: 400,000 credits at eight-tenths of a cent is roughly $3,200 per month, or about $32 per user per month of incremental exposure stacked on top of the existing license. For a hundred-seat deployment that is a rounding error. For a thirty-thousand-seat deployment it is a nine-hundred-sixty-thousand-dollar annual line item that did not exist in last year's budget, triggered by a configuration change that most customers will never consciously make. Tracing the vector of narrative contagion here is straightforward, because the default effect is one of the most reliably replicated findings in applied behavioral economics. The overwhelming majority of customers never modify a default. They modify it when it hurts, which is to say after the first overage invoice, which is to say after the budget cycle has already been set. The vendor does not need to raise prices to raise revenue. It needs to ship a default. And the fact that the same change bundle also unbinds Copilot from the base subscription, renames the SKU identifiers, and slips the effective date from early November to December 1 is not three unrelated housekeeping items. It is one coordinated migration, and the slip is the signal — it means the channel was not ready, which means a long tail of small managed service providers will be reconciling unfamiliar billing mechanics against unfamiliar SKU names for at least two quarters, and passing that reconciliation cost to their end customers, where it will be invisible because it is baked into a managed-services margin rather than a software line item. Decoding the silence between the blocks applies with unusual force to Salesforce's rate card. The two-dollar-per-conversation construct is still visible on the page, annotated as available only to existing Agentforce Conversations customers. This is price archaeology, and it is a trap. A buyer searching for benchmarks will find the old conversation price, and a third-party review written last year will quote it, and the number will look authoritative and be dead. The live construct is ten cents per action. Whether that is cheaper or catastrophically more expensive than two dollars per conversation depends entirely on one unpublished ratio: how many actions the average conversation contains. At twenty actions per conversation the two prices are identical. At five actions per conversation, the action model is four times more expensive. That ratio has never been published. It is, functionally, the exchange rate between the retired currency and the current one, and it is being set by the party that benefits from the confusion. Unearthing the alibi in the transaction logs is the only way to price this, and the logs belong to the vendor. Now step back, because the frame most analyses are using is wrong, and the wrongness matters. The common reading of all this is that the industry lacks pricing standards, and that standards would fix it. That reading is comfortable and it is backwards. Look at the tier structure and the correlation is impossible to miss: the vendors with the strongest ecosystems and the deepest enterprise channels publish the least, and the challengers publish the most. Microsoft and Salesforce publish rate cards but bury the variables — burn rates, default configurations, SKU lifecycles — in partner documentation. The strongest model provider publishes nothing enterprise-facing at all, routing every deal through sales. Google and ServiceNow publish nothing, anywhere. And the two challengers, xAI and Meta, publish actual numbers, because published numbers are the only customer-acquisition lever a challenger has that does not require a channel it does not own. xAI's standard API card is fully public at $2 and $6 per million tokens while enterprise deals get no published rate card — a textbook funnel strategy, transparent at the top, closed at the bottom, structurally identical to how the cloud market was seeded fifteen years ago. Mapping the topology of hidden incentives produces an uncomfortable conclusion. Transparency is not a virtue that the strong have failed to adopt. Transparency is a competitive weapon that the weak are forced to deploy. For an incumbent with brand equity and a sales force, opacity is worth more than clarity, because opacity permits price discrimination across a customer base with wildly different willingness to pay, and because a published price is a ceiling that a sales team can never argue above. The moment a dominant vendor publishes its real number, it hands its challengers a target and its customers an anchor. So it publishes an anchor instead — a seat price low enough to feel like an entry ticket — and hides the variable that determines the actual bill. Anthropic's twenty dollars per seat is the cleanest example in the set. It is deliberately calibrated to the consumer subscription tier, which is to say it is calibrated to feel familiar and small. The usage, billed separately at standard API rates, may run five to twenty times the seat fee. That is not deception in any legal sense. It is anchoring, and it works. Interrogating the consensus of the crowd requires me to state plainly what the consensus is getting wrong. The consensus says enterprises cannot budget for agents because prices are hidden. The sharper claim is that enterprises cannot budget for agents because the cost driver is a behavior, not a quantity. You can forecast seats. You can forecast storage. You cannot forecast how aggressively an autonomous agent will decide to call tools when it encounters an ambiguous task, because that decision is made by the model at runtime and varies with prompt phrasing, retrieval quality, and how the orchestration layer was configured during a pilot six months ago by a systems integrator who has since moved to another project. A traditional software budget lands within five percent. An agent budget is a function of usage intensity, task complexity, context length, and human review ratio, and at least two of those variables are unknown at the moment of signing. This is a discontinuity in financial planning, not a quoting inconvenience, and no amount of vendor phone calls resolves it. The three-metering-unit taxonomy is the analytical key, and it deserves more attention than it is getting. Billing per token, per action, and per conversation are not three ways of measuring the same thing. They are three different allocations of risk. Bill per token and the supplier carries the efficiency risk, because a customer with a better prompt burns fewer tokens and pays less. Bill per action and the customer carries the complexity risk, because a genuinely complex workflow compressed into a single action is a loss for the supplier, while a simple task decomposed into five actions is a loss for the customer — and the decomposition is decided by the orchestrator, not the buyer. Bill per conversation and both parties are gambling on an average that neither controls. The choice of unit is therefore not a presentation decision. It is a transfer of risk, and the party that gets to define the unit gets to choose which side of the trade it stands on. Whoever defines what counts as one action holds pricing power that never appears on any rate card. This is where my own work on metering, oddly, converges with the enterprise problem. In 2021 I spent four hundred hours inside Curve's governance emissions and concluded that liquidity is a political construct rather than a mathematical function — that the concentration of voting power among a handful of wallets would eventually express itself as a liquidity event, which it did, three weeks after I published. The lesson I carried out of that cycle was not about stablecoins. It was that any system where the measurement of a resource is controlled by the parties who benefit from the measurement will eventually be captured. DeFi learned this and built on-chain accounting, where every unit of resource consumed is a public, replayable, falsifiable fact. Enterprise AI has learned nothing and built the opposite: a metering layer that is private, unauditable, and adjustable by the issuer, sitting underneath a billing relationship worth more than most DeFi protocols will ever custody. I want to be careful here, because the reflexive crypto answer — put it on-chain — is mostly wrong, and I have spent enough years watching that reflex fail to indulge it. Most enterprises do not want their inference billing on a public ledger, and the transparency that would discipline the credit issuer is precisely the transparency their own procurement departments do not want exposed to competitors. This is the same structural mistake the tokenization crowd has been making for three years: the assumption that traditional institutions are waiting for a public chain to solve a problem they experience as a feature. They are not. They experience opaque bespoke pricing as a benefit, because it lets them negotiate, and they experience public metering as a liability, because it lets their competitors reverse-engineer their scale. The public chain does not need to be in the loop. The verifiable computation does. That distinction is the actual insight, and it comes out of the pilot I have been running this year with an AI startup in Sydney on sovereign identity for autonomous agents. The problem we set out to solve was narrow: how does an agent prove it is competent to perform a task without revealing the proprietary weights that make it competent? The answer we built used zero-knowledge proofs over inference attestations — the agent proves properties of what it computed without disclosing the computation. It took me about a week to realize that the same primitive solves the metering problem, and that nobody in enterprise procurement has noticed. If an agent can emit a zero-knowledge attestation of the resource it consumed — this action required this many tokens, this many tool calls, this many retrieval hops, and here is a proof that does not reveal the customer's data — then the credit becomes auditable without becoming public. The buyer can verify the burn rate without exposing the workload. The vendor retains confidentiality. The unilateral right to change the conversion rate in secret dies, because the conversion is now provable. That is the information gain I would put in front of any enterprise architect reading this, and it is the piece the pricing debate is missing entirely. The industry is arguing about whether prices should be published. The better question is whether consumption should be provable. Publishing a price against an unprovable unit changes nothing — you get a number that the vendor can silently invalidate by redefining the unit, which is exactly what the retired conversation card already demonstrates. Making the unit provable changes everything, because it converts a private currency into a measured quantity, and measured quantities can be compared, budgeted, and contracted against. The cryptography to do this has existed for years. The incentive to deploy it does not exist at any incumbent, which is why it will arrive from the challenger side or not at all. Here is the pre-mortem, because assuming failure first is the only honest way to evaluate a system this young. Assume the current trajectory holds. Within four quarters, the default effect converts a large share of mid-market Copilot deployments into metered billing without an explicit customer decision. Finance teams discover overages in the first reconciliation cycle and respond the way finance teams always respond — by imposing caps. Capped agents stop mid-workflow, which is worse than a slow agent, because a production system that halts on a credit ceiling is an availability incident dressed as a billing event. Procurement responds by demanding price protection clauses, which the top-tier vendors will grant selectively and the challengers cannot afford to grant at all, widening the moat. Credits proliferate as a private unit of account across three or four ecosystems that never interoperate, and a secondary market in unused committed capacity emerges informally, off-contract, unenforceable, and structurally identical to the gray markets that form around every non-transferable quota regime. The audit gap persists, because nobody has an incentive to close it, and the first serious incident — an agent loop that burns a six-figure credit balance overnight because an orchestrator failed to detect a retry storm — will be treated as an operational mistake rather than what it is, a metering design failure. And underneath all of it, the load-bearing wall that is priced at zero. Every action these systems bill for — the refund, the record change, the outbound message — lands in a real business process that requires human verification before it becomes irreversible. That review labor appears in no vendor invoice. It appears in no AI project ROI calculation. In employment statistics it is classified as an existing role rather than a new cost of automation. So the total cost of ownership for an agent deployment is systematically understated by an amount that scales with exactly the thing vendors are selling, which is the volume of autonomous actions taken. A thirty-thousand-seat reference deployment measured on adoption rather than productivity is the purest expression of this: the KPI rewards consumption, the billing rewards consumption, and the only countervailing force is a human reviewer whose time is booked to a different cost center and therefore invisible to the business case. The adoption metric and the revenue metric are the same metric. That is not a coincidence. It is the business model. Which brings me to the uncomfortable parallel that the enterprise software industry will not enjoy hearing from someone who has spent a decade auditing governance systems. The credit is a governance token with a dividend of zero. It confers no ownership, no claim on cash flow, no voting right over the burn rate, and no protection against dilution — and its issuer retains the unilateral authority to change the terms of consumption at will. The only way a holder of credits extracts value is by consuming them before the issuer redefines them, which is structurally the same position as a holder of a governance token whose only exit is a later buyer. I have made this argument about DAO tokens for years and been told it was uncharitable. It is not uncharitable. It is arithmetic. The enterprise credit and the governance token are two instances of the same design pattern: a private unit of account issued by a party that controls both the supply schedule and the redemption terms, sold to buyers who believe they are purchasing access to a resource rather than accepting an unsecured claim on a counterparty's future discretion. The difference, and it matters, is that the crypto market at least pretends to audit. On-chain accounting made every issuance visible, every burn replayable, every governance change a public event with a timestamp. Enterprise credits have none of that and have inherited none of the scrutiny, because the buyers are Fortune 500 procurement departments who assume that a rate card published by a company with a legal department must be a contract. It is not a contract. It is an advertisement with a footnote, and the footnote is where the pricing power lives. So what should a buyer actually do, in a sideways market where nobody is going to hand them a clean comparison? Three things, and none of them involve waiting for standards. First, contract for the burn rate, not the sticker price — a locked conversion between credits and actions for the contract term, with a defined notice period and a cap on any adjustment, because the published price is the least important number on the page. Second, insist on overage behavior in writing: does the agent halt, degrade, or continue at a stepped rate, because a production system that stops on a ceiling is a different risk category entirely than one that bills more. Third, demand consumption attestation at whatever fidelity the vendor can provide today, and start building the internal capability to verify it, because the moment one competitor offers provable metering the rest will have to match it, and the buyers who already know how to read an attestation will be the ones who can negotiate against it. Where this goes next is not toward transparency. It is toward verification, and the two are not the same thing, and the industry will spend at least another year conflating them. The vendors will keep publishing anchors and hiding variables, because that is what dominant vendors do and no regulator in any jurisdiction has yet shown the appetite to treat a credit as a financial instrument, which is what it functionally is. The challengers will keep publishing real numbers, because they have no other lever. The auditors will keep ignoring the metering layer, because it sits between the software contract and the compute bill and belongs to neither. And the first serious overage incident will arrive, and it will be classified as an operational error, and the lesson will not be learned. Follow the incentives, not the price. The price is the part they showed you. The burn rate is the part they kept. And the wall holding the whole structure up — the human who checks the agent's work before it becomes irreversible — is the one component in this entire stack that carries real operational risk and is priced, on every rate card in the market, at exactly zero.