Two threads of work shipped this week: the Guardrail console grew the features a multi-org product needs, and we spent real time attacking what we’d built. Both matter for the same reason — a security product should be held to the standard it sells.

What changed in the console

  • Org-scoped keys, end to end. Engine API keys now carry their organization through the whole path — so usage metering, limits, and billing are attributed per org by construction, not by convention. An org’s keys meter to that org. No shared accounting.
  • Audit-first tier gating. Every organization starts in audit mode: real verdicts, zero blocking. Flipping to enforce is one admin toggle — and enforcement, key limits, and a monthly check-limit hard stop are gated by plan tier, with alerts at 80% and 100% of volume.
  • Events and billing. Per-org monthly usage, with the Stripe billing path already live for self-serve checkout.
  • Monitoring that watches the watcher. The live deployment now runs Prometheus + Grafana, scraping the console and engine metrics.

Then we attacked it

  • The two-machine drill. A fresh machine paired with the console through the same one-click pairing flow a customer uses, end to end: credentials exchanged, policy synced, and every check attributed to the right org. Green.
  • SSRF probes against the console’s own endpoints, and token-scoping checks on the internal key types.
  • Guardrails in the tooling. The Helm chart now refuses to render with more than one engine replica (the engine deliberately allows only one writer; the API docs now say so plainly), and CI grew a cross-platform matrix — Linux, macOS, Windows — for the Rust test suite plus the desktop build.

None of this is glamorous. It’s the part of a security company’s job that happens off the marketing page: verifying that the pairing flow you publish works, that a key belonging to one org can’t meter to another, that the deploy tooling can’t be misconfigured into a silent mistake.

The open items from the wave are on the roadmap — and the drills continue. That’s the point.