diff --git a/public/docs-static/img/agent-network/integrations/agent-network-bedrock-connect.png b/public/docs-static/img/agent-network/integrations/agent-network-bedrock-connect.png
new file mode 100644
index 000000000..6692d6909
Binary files /dev/null and b/public/docs-static/img/agent-network/integrations/agent-network-bedrock-connect.png differ
diff --git a/public/docs-static/img/agent-network/integrations/agent-network-bedrock-mappings.png b/public/docs-static/img/agent-network/integrations/agent-network-bedrock-mappings.png
new file mode 100644
index 000000000..afa46337e
Binary files /dev/null and b/public/docs-static/img/agent-network/integrations/agent-network-bedrock-mappings.png differ
diff --git a/public/docs-static/img/agent-network/integrations/agent-network-litellm-mappings.png b/public/docs-static/img/agent-network/integrations/agent-network-litellm-mappings.png
new file mode 100644
index 000000000..7b8e8e23d
Binary files /dev/null and b/public/docs-static/img/agent-network/integrations/agent-network-litellm-mappings.png differ
diff --git a/public/docs-static/img/agent-network/providers/agent-network-provider-metadata.png b/public/docs-static/img/agent-network/providers/agent-network-provider-metadata.png
new file mode 100644
index 000000000..41e660bbb
Binary files /dev/null and b/public/docs-static/img/agent-network/providers/agent-network-provider-metadata.png differ
diff --git a/src/pages/agent-network/how-it-works.mdx b/src/pages/agent-network/how-it-works.mdx
index edb6527d8..a45d67fff 100644
--- a/src/pages/agent-network/how-it-works.mdx
+++ b/src/pages/agent-network/how-it-works.mdx
@@ -105,7 +105,10 @@ upstream:
Guardrails](#policies-limits-and-guardrails).
5. **Stamp identity for the gateway.** Add the caller's identity to the upstream request
(for example into `metadata.tags` and `x-litellm-end-user-id`) for gateways that key
- their own budgets and attribution off it.
+ their own budgets and attribution off it, or into a provider's own cost-allocation
+ metadata such as AWS Bedrock's `X-Amzn-Bedrock-Request-Metadata`. This is on by default
+ and can be turned off per provider — see [Identity
+ Metadata](/agent-network/providers#identity-metadata).
6. **Apply guardrails.** Enforce the model allowlist and the prompt-capture rules.
The request is then forwarded to the upstream API or gateway. On the response leg, in
diff --git a/src/pages/agent-network/integrations/bedrock.mdx b/src/pages/agent-network/integrations/bedrock.mdx
index 1f8cce082..064493339 100644
--- a/src/pages/agent-network/integrations/bedrock.mdx
+++ b/src/pages/agent-network/integrations/bedrock.mdx
@@ -48,6 +48,10 @@ for details.
5. Save the provider. The key is now held server-side — the next step authorizes who can use
it.
+
+ 
+
+
See [Providers](/agent-network/providers) for details.
## Create a Policy
@@ -64,6 +68,29 @@ before anyone can route through it.
See [Policies](/agent-network/policies) for details.
+## Cost Allocation
+
+NetBird forwards the caller's identity to every provider by default — see
+[Identity Metadata](/agent-network/providers#identity-metadata) for the general behavior and
+how to turn it off. For Bedrock that identity lands in the
+[`X-Amzn-Bedrock-Request-Metadata`](https://docs.aws.amazon.com/bedrock/latest/userguide/cost-mgmt-request-metadata.html)
+header — the one AWS reads for cost-allocation tags — carrying the caller's **user** and the
+**group that authorized the request**:
+
+```
+X-Amzn-Bedrock-Request-Metadata: {"user": "user@example.com", "group": "engineering"}
+```
+
+Activate the matching **cost-allocation tags** in **AWS Billing and Cost Management → Cost
+allocation tags**; Bedrock spend in AWS Cost Explorer can then be broken down by NetBird user
+and group. Values are sanitized to Bedrock's accepted character set before they are sent.
+
+The provider's **Mappings** tab shows exactly what NetBird sends:
+
+
+ 
+
+
## Use with Claude Code
To route [Claude Code](/agent-network/integrations/claude-code) through this Bedrock provider
diff --git a/src/pages/agent-network/integrations/litellm.mdx b/src/pages/agent-network/integrations/litellm.mdx
index 5a2509d53..da4058f64 100644
--- a/src/pages/agent-network/integrations/litellm.mdx
+++ b/src/pages/agent-network/integrations/litellm.mdx
@@ -54,7 +54,13 @@ the gateway can attribute usage and enforce its own controls:
budgets and rate limits.
- The **user identity** is sent in the `x-litellm-end-user-id` header.
-The proxy strips any client-supplied value first, so an app can't spoof its identity.
+The proxy strips any client-supplied value first, so an app can't spoof its identity. To stop
+forwarding identity to LiteLLM, turn off
+[Forward identity metadata](/agent-network/providers#identity-metadata) on the provider.
+
+
+ 
+
The configured key must be a LiteLLM **virtual key** with `metadata.allow_client_tags: true`,
diff --git a/src/pages/agent-network/providers.mdx b/src/pages/agent-network/providers.mdx
index b5f1ec8e1..cfd730878 100644
--- a/src/pages/agent-network/providers.mdx
+++ b/src/pages/agent-network/providers.mdx
@@ -91,6 +91,24 @@ skipping verification.
The switch appears only for custom (self-hosted) providers and is **off by default**.
+### Identity Metadata
+
+By default NetBird stamps the caller's **user** and the **group that authorized the request**
+onto each upstream request, so the provider or gateway can attribute usage to the real caller
+instead of the shared API key. The exact header or field is provider-specific — see the
+provider's [integration guide](/agent-network/integrations) for details (for example, AWS
+Bedrock carries it in a header used for [cost-allocation tags](/agent-network/integrations/bedrock#cost-allocation),
+and AI gateways receive their own attribution headers).
+
+This is controlled by the **Forward identity metadata** toggle on the provider — **on by
+default**, and shown only for providers that support it (first-party APIs such as OpenAI or
+Anthropic have no such metadata channel, so the toggle doesn't appear for them). Turn it off
+to keep the caller's identity out of the upstream request.
+
+
+ 
+
+
## Models and Pricing
Each provider carries a list of models it serves. Leaving the list empty makes the