Inference demand is not flat. It follows people's working days and time zones, product launches and batch jobs. The Aryl paper (EuroSys 2023) gives a clear measurement. In a production inference cluster of about 4,000 GPUs, peak traffic lasted about four hours at night and demand bottomed out before dawn. The peak-to-trough ratio was about 2.2 within a day, and average utilisation was about 65%. That cluster was sized for the peak, as inference clusters must be, so a third of its capacity sat unused on an average day.
Most operators will recognise the pattern. Capacity is bought for peak, committed tenants use it unevenly, and the hours in between go unsold. Those hours could serve inference, but only if the operator can sell them without a sales team, a custom integration or a long contract for every buyer. This article covers what that takes.
1. A machine identity that buyers can trust
On an open network, a buyer is not choosing a company it has vetted. It is choosing a machine it has never seen, so the first requirement is that the machine can prove which one it is.
That rules out several common shortcuts. A GPU serial is a weak identity: GPUs are swapped, resold and partitioned, so the identity follows the card rather than the server. A key in a configuration file is weaker still, because anyone who copies the file becomes the machine. The robust anchor is a hardware root of trust on the host, such as a TPM 2.0 endorsement key, with the signing key sealed to it.
For operators this has a direct commercial payoff. Every receipt, availability answer and payment then points to a physical server you own, and nobody else can claim your track record.
2. A model supply you do not have to curate
Selling inference means serving models, and every model brings a licence, a set of weight files and a serving configuration. Operators should not have to research each one by hand. They need a catalogue in which each entry pins the exact file hashes to a source commit and records the licence and its commercial conditions. It should also say whether paid serving is allowed at all.
Two properties matter. Weights whose bytes do not match the pinned hashes must be refused at load time, so a corrupted or substituted file never serves. Licence acceptance must be explicit and recorded, so a model with non-commercial or custom terms is never served for pay by accident.
3. Metering that matches the work
AI work comes in many units. Language models bill on input and output tokens, speech on audio seconds, image and video generation on pixels times denoising steps, embeddings on input tokens and forecasting on points. A rate card has to price each unit, and the meter has to be hard to inflate.
The useful discipline is that every billed dimension is capped by what actually crossed the wire. Output tokens cannot exceed the request's limit or the bytes returned, and prompt tokens cannot exceed the bytes sent. A buyer who can check the bill against the traffic will pay a provider it has never met.
4. Proof of availability, not promises
Capacity rental lives or dies on availability. A buyer renting a GPU for a week needs to know it was actually there. In a bilateral contract, the provider's monitoring reports on the provider. On an open network that does not work, because the party being measured would be the one doing the measuring.
The alternative is independent probing. Third parties send unpredictable challenges that the machine must sign within a deadline, and a quorum of them reaches a verdict for each period. Payment then follows the verdicts: periods judged available are paid, and periods judged unavailable return to the renter. As Dean and Barroso showed for large services, the tail matters more than the average. A clear, periodic availability verdict is the tail measure a capacity buyer actually needs.
5. Settlement without a credit relationship
The last obstacle is getting paid. Selling spare hours to many small buyers is only worth it if each sale costs almost nothing to collect. That means funds committed before work starts, released as work is verified, with no invoices, chargebacks or credit checks.
A streaming escrow suits capacity. The renter locks the full term up front, value is released each period the machine is judged available, and either side can stop at a period boundary. A per-call settlement against a signed receipt suits inference. Both remove the collection problem that keeps operators away from small buyers.
Visibility and tenancy
Operators with anchor tenants also need control over what they offer. A node might serve some models publicly to any paying caller, others only to named customers, and nothing at all to the outside world during a tenant's reserved hours. Visibility should be a single setting with per-resource overrides, so opening spare capacity never exposes a reserved one.
What this means for data-centre operators
The opportunity is concrete: the gap between the capacity you built for peak and the capacity your tenants actually use. Capturing it depends less on new hardware than on five pieces of plumbing: hardware-rooted identity, a verifiable model supply, honest metering, independent availability verdicts and pre-funded settlement. If a platform asks you to trust its monitoring of your machines, or asks buyers to trust your monitoring, it has not solved the problem.
There is a regulatory angle as well. In the EU, the Data Act has applied since September 2025 and makes switching between data processing services easier for customers. Standard interfaces and per-request pricing suit that environment better than long lock-in contracts.
Where Tenzro fits
Tenzro is an open network where machines sell AI work to agents and apps. It is live in preview, and governance decides the steps to testnet and mainnet. For operators, what is built:
- One command to provide. On a node running the AI role,
tenzro join --providerdetects the hardware, provisions a hardware-rooted wallet, posts the provider bond, registers the provider, sets default pricing, and pulls and serves the largest catalogue model that fits the machine. - Hardware identity. Machine identity is rooted in the host's attestable hardware (TPM, Secure Enclave, SEV-SNP and others), never in a GPU. Signing keys are sealed to that root and never written as plaintext.
- Signed catalogue. Entries pin every file's SHA-256 to a source commit, record licence tiers and conditions, and mark models whose licence forbids paid serving. A mismatched file refuses to load.
- Rate cards per unit. Operators price tokens, pixel-steps, audio and other units, with a per-call minimum. Forwarded calls are billed from signed receipts and capped by what was sent and received.
- Compute rental. A renter opens a streaming escrow to the provider. Validators probe every bonded provider every ten minutes, and an hour's verdict is frozen once validators holding two thirds of bonded stake have attested. Hours judged unavailable are never paid out.
- Visibility. Each node is public, gated or private, with per-resource overrides.
- Hardware coverage. Container images target NVIDIA CUDA (x86_64 and arm64), AMD ROCm and Vulkan.
Settlement on chain uses TNZO, the network's unit for pricing and settling work. Fees are set in USD terms, and buyers are not required to hold it.
