Authorization + billing substrate — OpenFGA and Lago land as first-class

Two substrate pieces landed this week that don’t look like a product update but change what the platform can do: OpenFGA for authorization and Lago for billing and metering. Every plan-tier gate, every per-resource permission check, and every consumption meter downstream of this change now goes through them.

OpenFGA — per-resource authorization

The auth layer used to answer “does this user have this role?” It now answers “does this user have this permission on this specific resource?” OpenFGA (an open-source Zanzibar-style authorization service originally built at Auth0) is the reasoning engine underneath the change. Every read and every write the platform performs goes through an OpenFGA check that grounds the decision in the authorization model — user → role → resource → scope — not in a hard-coded conditional.

The practical difference: a compliance manager on the customer’s Ultra plan can see and manage all of their organization’s controls, but they can’t see the DD room a partner org is running an engagement inside; a partner analyst granted access to a specific engagement can only see that engagement’s artifacts; an auditor invited into a customer’s tenant can read the evidence they were scoped to and nothing else. The scoping is a first-class property of every call, not an afterthought.

Lago — billing and metered consumption

Lago is an open-source metering and billing platform that sits between the platform and Stripe. Every plan-tier entitlement is expressed as a Lago rule — how many users, how many connections, how many scans per month, how much AI inference — and every event that touches those meters goes through Lago before it becomes a Stripe invoice line item.

The practical difference: consumption charges for AI-grounded tools (like the ones the diligence product will use once it ships in May, and like the ones the MCP surface will expose once it ships in May as well) can be metered in real time, capped per organization to prevent runaway spend, and rolled into a Stripe invoice automatically. No custom billing plumbing per surface.

Why it matters

Neither piece is customer-visible on its own — together they are what makes every subsequent tier-gated feature, per-resource permission, and metered service actually work at the platform layer instead of being an afterthought in each service. Every product update downstream of this week — and there are a lot of them — inherits both.