Protection

Measuring tells you which requests lost money after they ran. Protection moves the question to before the call, which is the only point where the answer can still change anything.

One wrapper

guard() does the whole loop: ask, run your call with the resolved model, report what it actually cost, and tell MarginFuse what your application did.

import { MarginFuse } from "marginfuse";

const mf = new MarginFuse({ apiKey: process.env.MARGINFUSE_KEY! });

const out = await mf.guard(
  { customerId: "cus_8x2m91", feature: "ai_chat", provider: "openai", model: "gpt-4.1" },
  // `model` is the one to actually call: a downgrade verdict changes it.
  async ({ model }) => {
    const r = await openai.chat.completions.create({ model, messages });
    return {
      result: r,
      usage: {
        inputTokens: r.usage.prompt_tokens,
        outputTokens: r.usage.completion_tokens,
      },
    };
  },
);

if (out.kind === "completed") {
  useResult(out.result);
} else if (out.kind === "topup_required") {
  // Your own UX. `out.decision.topupContext` is whatever the policy configured.
  showTopupPrompt(out.decision.topupContext);
} else {
  showLimitReached();
}

The four verdicts

Dry run comes first

A new policy does not act. It evaluates against your real traffic and records what it would have done, so you can read a week of decisions before anything is allowed to change an outcome. Turning a policy live is per policy and reversible.

This is also why savings are credited on acknowledgment rather than on the decision. The SDK tells MarginFuse what your application actually did, and a call that was merely presented as needing a top-up does not count as avoided: the customer may have paid and proceeded.

What happens when MarginFuse is down

Your requests run. That is the entire answer, and it is not configurable.

• A decision that times out, errors, or comes back unparseable resolves to allow, with degraded: true and a reason.
• The default budget is 1500 ms. Your provider call has not started yet, so this is the only latency MarginFuse can add to a request.
• Being rate limited behaves the same as an outage: unmeasured and unprotected, never broken.

The consequence is worth stating plainly: protection is best effort by design. If MarginFuse cannot answer, a loss-making request goes through rather than a paying customer seeing an error.