GeezerVison

Kinds of price, in lookup order, most specific first:

1. One org, one configured provider (provider ID). New table ai_org_provider_model_prices, primary key (organization_id, provider_id, model). The provider type comes from ai_providers.
2. One org, every provider of a type. New table ai_org_model_prices, primary key (organization_id, provider, model), with CHECK (provider <> 'openai-compat').
3. Site-wide custom price for a provider type. Existing ai_model_prices, unchanged.
4. Site-wide default from the built-in price book. Existing ai_model_prices, unchanged.

Decisions

• Org prices always win over site-wide prices. There are no site-wide provider-ID prices.
• Blanket openai-compat prices stay rejected, because each gateway can route to a different upstream. Allowing them later would be additive.
• Foreign keys to organizations and ai_providers use ON DELETE CASCADE. Prices for soft-deleted providers are never matched and are hidden by the API.
• The lookup is one UNION ALL query of primary-key lookups, ordered first by whether the row is for the requested model, then by kind. The ai_model_price_kind enum is declared most specific first.
• No feature flag: the endpoints are experimental and licensed, and org prices take effect only once set.
• Site-wide routes are unchanged, including POST returning 204, which the coderd_ai_model_price Terraform resource depends on.
• The org comes from the route. Upserts take provider or provider_id; a provider_id must be a live provider, and a provider given alongside it must match its type. Invalid entries, duplicate keys and blanket openai-compat prices return 400, and nothing is written.
• GET on the org route returns every price that applies to the org. By default it lists effective prices, so an org type price hides the matching site-wide prices. source=all lists every row. Each row shows its scope.
• Org prices are identified by their natural key. DELETE takes provider_id or provider, plus model, in the query string, because model names can contain slashes. There is no surrogate ID for now.
• All three tables are kept, and the matched kind is recorded per token usage record but not exposed yet (Sas Swart, 13 Oct).

Out of scope: the UI (AIGOV-699), Terraform support for org prices (AIGOV-710), and passing the organization from interceptions into the lookup, which depends on org context work.