AI providers & governance

Two levels of control

Platform console → Organisations → AI governance lets designated operators enable AI, permit company-owned keys, approve providers and set a maximum daily allowance. Company settings → AI & automation manages connections and feature choices within that policy. Ordinary administrators cannot change platform limits.

Environment settings supply the installation kill switch, provider ceiling and optional deployment-managed credential. Existing deployment credentials remain read-only in the dashboard.

Connect a provider

1. Ask your operator to enable your company and permit the provider and company keys.
2. Choose Add connection, name it, select OpenRouter, OpenAI, Anthropic · Claude or DeepSeek, and enter an exact supported model ID and key.
3. Review the account processing, retention and regional terms. Save securely; saved keys cannot be retrieved from the browser.
4. Test connection with fictional content. The test may incur a provider charge and counts toward the shared daily limit. A passing probe does not certify every model feature or training quality.
5. Activate explicitly, then select the connection for Course drafting or Resource answers and save feature settings.
6. Review generated content before saving a draft or publishing. No AI action publishes automatically.

Rotation, privacy and failures

Editing or rotating disables a connection and invalidates its test. Retest and activate before use. A blank key retains the old one only when the provider is unchanged. Remove saved key erases its ciphertext while retaining audit/usage records. Revoke the key at the provider separately.

One connection is selected per feature. Failure, disablement or removal never silently selects another provider or account. A configuration change requires refreshing and reviewing the destination again before generation.

Four explicit adapters are supported, not arbitrary API URLs. OpenRouter routing privacy controls do not apply automatically to direct providers. Review each provider agreement; store=false is not a zero-retention guarantee. Custom destinations and automatic failover are not offered.

Usage and troubleshooting

The screen shows today’s UTC attempts, outcomes and provider-reported token measurements by provider/model/operation. Tests, failed and interrupted calls count. The default is 20 combined daily attempts; company and installation limits can lower or raise it within the operator ceiling. This is not a billing invoice; configure provider-account spending caps.

Keys are encrypted server-side through the existing key infrastructure. Browser writes require current administrator authority, CSRF validation and a recent sign-in. If denied, sign in again and check policy. For conflicts reload settings or retest; for provider failures check exact model capability/account availability.

OpenBao must be available for company-owned credentials. Automatic unsealing and off-server backup remain operator setup TODOs. Broader document ingestion, learner tutors, historical usage reports and autonomous workflows are not included.

Self-hosted defaults and API

Enable only the controls you intend. Company keys also require platform policy and working encrypted storage. Optional deployment credentials use a private key file; direct providers require the privacy-reviewed flag. Restart the API after environment changes. No browser-exposed VITE_ secret is allowed.

The API reference’s AI governance group documents redacted reads, revisioned connections, test/activate/disable/remove-key actions, routing and operator policy. Browser sessions are required; these are not third-party token APIs. Generation includes the matching configuration fingerprint returned by availability.

AI_DRAFTS_ENABLED=false
AI_RESOURCE_ASSISTANCE_ENABLED=false
AI_COMPANY_KEYS_ENABLED=false
AI_ALLOWED_PROVIDERS=openrouter,openai,anthropic,deepseek
AI_MAX_DAILY_ATTEMPTS=1000
AI_PROVIDER=openrouter
AI_MODEL=openai/gpt-4.1-mini
AI_API_KEY_FILE=
AI_PROVIDER_PRIVACY_REVIEWED=false