One credential model
A publishable key for the browser, a secret key for your server, and short-lived client sessions your backend mints for a single capability.
Three types, one prefix convention, and the environment in the prefix.
One authorisation model
The same policies serve the API and the web interface. A permission written for a person is the permission an integration inherits, narrowed by its scopes.
There is no second authorisation system to keep in step with the first.
One organisation, resolved for you
The credential decides the organisation, the environment and the enabled services. There is no organisation id to send and no header to set.
A cross-organisation identifier is refused during route resolution.
One meter, read per service
Every operation writes a usage record carrying its operation key, quantity, billing unit and cost, so "what did Processor cost this month" is a query rather than an allocation exercise.
Free operations are recorded in full, because the count still matters.
One set of wire conventions
A versioned path, responses under a data key, stable error codes, idempotency keys on anything that costs money, and rate limits applied per credential and per organisation.
Additive changes ship inside v1. Breaking ones get a new version.
One audit trail
Every mutating operation has a named actor, and that actor is written to the trail and onto the record. Services do not keep separate histories that have to be reconciled.
The actor is required, not derived, and never optional.