On yc-software/qm, a public commit adds individual model authorization. When an organization enables it, a human must connect a Claude, ChatGPT, or API-key account before chatting; the human turn then routes through that connection rather than the organization’s shared model credential.
That is more than a model picker. It separates two things agent software often collapses: the company may host the service and operating controls, while the person at the keyboard supplies the account that drives a model turn. For teams balancing subscriptions, reimbursement, auditability, and shared API budgets, that is an operating choice—not a cosmetic preference.
The account chooses a path, not just a label
The inspected routing module does not treat all connections alike. Anthropic OAuth selects the Claude harness; OpenAI OAuth normally selects a Codex harness, with a Pi organization able to keep its own harness while using the subscription provider; a pasted API key follows the Pi route for the named provider. In other words, the account connection can determine the harness and model path, not merely decorate an organization-owned default.
QM also tries to make the custody boundary structural. Its public tests create credentials by user and provider, retrieve only derived OAuth material for a turn, and check that a Codex child auth file carries an access token and account identifier without the refresh token. That is a stronger design than swapping one shared credential file before each request and hoping concurrent turns put it back correctly. It is still host-managed custody: the service’s keychain owns encryption and refresh, so no reader should translate this code into a promise that the organization never holds sensitive material.
Not every task gets a personal bill
The important correction arrives in the orchestrator gate. The individual path runs only when the origin is a human turn and the organization toggle is enabled. If no connected account resolves, the turn is refused with a connection prompt rather than silently borrowing the organization credential. But automation and ambient work are not put through that branch. A scheduled report, cron-triggered job, or other background action remains a separate organization-level policy question.
That distinction is the story’s useful consequence. A company can let a person bring a subscription account to an interactive agent without pretending that every task, retry, monitor, or scheduled action has become personal. The public receipts are main-branch code and focused tests, not release or deployment evidence. The next signal worth watching is a public operational guide that tells administrators how the personal-account boundary appears in logs, billing, retention, and a failed or retried background task.