agent-network: identity metadata setting and Bedrock cost allocation (#857)

src/pages/agent-network/how-it-works.mdx

@@ -105,7 +105,10 @@ upstream:
    Guardrails](#policies-limits-and-guardrails).
 5. **Stamp identity for the gateway.** Add the caller's identity to the upstream request
    (for example into `metadata.tags` and `x-litellm-end-user-id`) for gateways that key
-   their own budgets and attribution off it.
+   their own budgets and attribution off it, or into a provider's own cost-allocation
+   metadata such as AWS Bedrock's `X-Amzn-Bedrock-Request-Metadata`. This is on by default
+   and can be turned off per provider — see [Identity
+   Metadata](/agent-network/providers#identity-metadata).
 6. **Apply guardrails.** Enforce the model allowlist and the prompt-capture rules.
 
 The request is then forwarded to the upstream API or gateway. On the response leg, in

src/pages/agent-network/integrations/bedrock.mdx

@@ -48,6 +48,10 @@ for details.
 5. Save the provider. The key is now held server-side — the next step authorizes who can use
    it.
 
+<p>
+    <img src="/docs-static/img/agent-network/integrations/agent-network-bedrock-connect.png" alt="Connect the AWS Bedrock provider in NetBird Agent Network" className="imagewrapper" />
+</p>
+
 See [Providers](/agent-network/providers) for details.
 
 ## Create a Policy
@@ -64,6 +68,29 @@ before anyone can route through it.
 
 See [Policies](/agent-network/policies) for details.
 
+## Cost Allocation
+
+NetBird forwards the caller's identity to every provider by default — see
+[Identity Metadata](/agent-network/providers#identity-metadata) for the general behavior and
+how to turn it off. For Bedrock that identity lands in the
+[`X-Amzn-Bedrock-Request-Metadata`](https://docs.aws.amazon.com/bedrock/latest/userguide/cost-mgmt-request-metadata.html)
+header — the one AWS reads for cost-allocation tags — carrying the caller's **user** and the
+**group that authorized the request**:
+
+```
+X-Amzn-Bedrock-Request-Metadata: {"user": "user@example.com", "group": "engineering"}
+```
+
+Activate the matching **cost-allocation tags** in **AWS Billing and Cost Management → Cost
+allocation tags**; Bedrock spend in AWS Cost Explorer can then be broken down by NetBird user
+and group. Values are sanitized to Bedrock's accepted character set before they are sent.
+
+The provider's **Mappings** tab shows exactly what NetBird sends:
+
+<p>
+    <img src="/docs-static/img/agent-network/integrations/agent-network-bedrock-mappings.png" alt="Bedrock identity metadata mapping: user to user email and group to groups in the X-Amzn-Bedrock-Request-Metadata header" className="imagewrapper" />
+</p>
+
 ## Use with Claude Code
 
 To route [Claude Code](/agent-network/integrations/claude-code) through this Bedrock provider

src/pages/agent-network/integrations/litellm.mdx

@@ -54,7 +54,13 @@ the gateway can attribute usage and enforce its own controls:
   budgets and rate limits.
 - The **user identity** is sent in the `x-litellm-end-user-id` header.
 
-The proxy strips any client-supplied value first, so an app can't spoof its identity.
+The proxy strips any client-supplied value first, so an app can't spoof its identity. To stop
+forwarding identity to LiteLLM, turn off
+[Forward identity metadata](/agent-network/providers#identity-metadata) on the provider.
+
+<p>
+    <img src="/docs-static/img/agent-network/integrations/agent-network-litellm-mappings.png" alt="LiteLLM identity mappings: x-litellm-end-user-id to user email and metadata.tags to groups" className="imagewrapper" />
+</p>
 
 <Note>
   The configured key must be a LiteLLM **virtual key** with `metadata.allow_client_tags: true`,

src/pages/agent-network/providers.mdx

@@ -91,6 +91,24 @@ skipping verification.
 
 The switch appears only for custom (self-hosted) providers and is **off by default**.
 
+### Identity Metadata
+
+By default NetBird stamps the caller's **user** and the **group that authorized the request**
+onto each upstream request, so the provider or gateway can attribute usage to the real caller
+instead of the shared API key. The exact header or field is provider-specific — see the
+provider's [integration guide](/agent-network/integrations) for details (for example, AWS
+Bedrock carries it in a header used for [cost-allocation tags](/agent-network/integrations/bedrock#cost-allocation),
+and AI gateways receive their own attribution headers).
+
+This is controlled by the **Forward identity metadata** toggle on the provider — **on by
+default**, and shown only for providers that support it (first-party APIs such as OpenAI or
+Anthropic have no such metadata channel, so the toggle doesn't appear for them). Turn it off
+to keep the caller's identity out of the upstream request.
+
+<p>
+    <img src="/docs-static/img/agent-network/providers/agent-network-provider-metadata.png" alt="Connect Provider modal with the Disable identity metadata toggle" className="imagewrapper" />
+</p>
+
 ## Models and Pricing
 
 Each provider carries a list of models it serves. Leaving the list empty makes the