In any traditional venue, there is a counter in the front of the house with a coat rail behind it. You hand over your coat, you get a disc, and the disc is worth exactly one coat. Nobody thinks the disc is the coat. Everybody knows who is accountable if the disc comes back and the coat does not.
That counter is a few feet from the box office, and the two of them issue different things for different reasons. The box office issues a receipt, which is proof that something happened. The cloakroom issues a token, which is a claim on something being held.
The latter is what the word token meant for a very long time. A token stands in for something, and somebody is responsible for the exchange. It traces back to Old English tacen, meaning a sign, and shares a root with teach. A token is what shows you a thing in the thing’s absence.
The AI industry uses that word for the unit it bills you by.
In the industry’s sense, a token is a fragment of text a model reads or writes, and it is the meter. Context windows are measured in tokens. Pricing runs per million tokens. Dashboards report tokens generated as if the number were the product itself.
What happened to the accountability?
In the cloakroom sense, a token is a claim on something specific, held by a named party, redeemable, and a promise. In the billing sense, a token is a quantity consumed, like a reading on a meter.
At Pensato the older meaning is the working one, and we use both, deliberately, in two different rooms.
The Meter
Tokens as consumption is the industry’s meter. We account for it honestly because it is real money and real capacity. Our posture is that a healthy system needs fewer of them every month for any task it has already mastered.
The Promise
Tokens as standing-in is the load-bearing sense, and is also the one that keeps regulated work defensible. It’s the one secure AI depends on.
When a document crosses our secure middle, the Personally Identifiable Information (PII) inside it does not travel with it. Each identifying value is exchanged for a secure token, and it behaves exactly like the cloakroom: it stands in for a specific real value, the mapping is held by a responsible party, and redeemable only by somebody with the authority to redeem it. A local LLM, running inside your environment, works on the token (not holding the coat).
Now, carry that into any AI conversation about sensitive data. Ask a vendor how many tokens their system uses, and you learn about the bill. Ask what their system tokenizes, and you learn whether the real value was ever in the room. Both questions use the same word, which is the problem.
At Pensato, The Promise Stayed
A token here is a stand-in with an owner and a redemption path, and the count is a separate conversation about the meter.
If your AI vendor can’t tell you what their system tokenizes and who holds the mapping back to the real thing, you don’t have secure AI.