Three honest paths.

1. Free sandbox session

The default path. Cookie-bound sandbox session, issued by the API on first visit to /onboarding. Workspace, provider, and endpoint records are durable across browser refresh. Open the Provider Workbench, run the 401 → 402 → 200 flow, see the Usage Proof Ledger render real session-correlated request rows.

• No sign-up. No email. No credit card.
• Durable per-session resources (1-hour TTL).
• Real self_serve.sandbox.*.created + gateway-pipeline events filtered to your session.
• No SLA, no real settlement, rate-limited.

2. Production pilot accountPilot-gated

A real organisation with org-level admin keys, real provider records, real upstream URLs, real receipts, real audit chains. The pilot path opens once counsel-reviewed terms land and Polar KYC completes.

• Operator conversation; not self-serve sign-up.
• Production gateway behind triple-gate opt-in.
• Admin RBAC: receipts, audit, proofs, payments.
• SSO (OIDC + SAML) and SCIM enterprise baseline.
• Public billing remains not_launched; pricing is conversation-only until counsel review + billing rail are in place.

3. Enterprise contactNot claimed

For organisations needing SSO, SCIM, SIEM, dataroom evidence, vendor security review, or contractual terms beyond the pilot proposal. Operator conversation only.

• SSO (OIDC + SAML) + SCIM enterprise baseline.
• SIEM signed-webhook + retention export.
• External verification dataroom evidence.
• Enterprise GA not claimed; SOC 2 / ISO 27001 / HIPAA / PCI not claimed.

Why provider sign-up is pilot-gated

• Counsel-reviewed terms not landed. Legal pages at /legal/terms + /legal/privacy ship as templates pending counsel review. We do not open self-serve sign-up against unreviewed terms.
• Public billing not launched. Polar webhook receiver is wired but publicBilling: not_launched; no paid plan exists.
• No multi-tenant org provisioning. Provider records under the org model exist; the self-serve path that maps a sign-up to a fresh org with bounded roles is the engineering work that opens this gate.

When the gate opens

The posture flips via deliberate code change in apps/api/scripts/product-ready.ts after: counsel review of legal templates lands; Polar KYC completes; multi-tenant org provisioning ships behind a deliberate ADR. Until then, the programmable posture surface at /v1/status and the human mirror at /status both report accountModel: sandbox_session + legalGate: pending_counsel_review honestly.