Appearance
AI Provider Settings
Where to find it: Administration, then AI Settings (/settings).
Two modes
| Mode | Meaning | Who configures |
|---|---|---|
| Hosted | AI is provided and managed by the platform operator | The platform operator |
| Bring-your-own-key | Your tenant supplies its own AI provider credentials | Your tenant administrator |
Which mode applies is granted at platform level. A tenant in hosted mode cannot switch itself to bring-your-own-key.
What every user sees
Any user with access to the page sees a read-only summary:
| Field | Meaning |
|---|---|
| Provider | The provider label |
| Model | The model in use |
| Mode | Hosted or bring-your-own-key |
| Enabled | Whether AI is active for the tenant |
The page states plainly that AI provider configuration is managed by your tenant administrator, and that users can still use AI features where their role allows.
Requesting a change
Any user on the page can submit a change request with a note, and optionally a desired mode, provider or model.
This is the route for a compliance function that wants a different model without holding administrative rights.
Bring-your-own-key configuration
Self-service configuration requires both:
- Tenant administrator role, and
- The tenant being in bring-your-own-key mode
A tenant administrator in hosted mode cannot configure AI
Both conditions are required. In hosted mode, configuration is platform-managed and self-service is refused — administrator rights alone do not override it.
Configuration covers the provider, the model, and the API key.
Testing
A test action verifies the configuration works before it is relied on. Run it after any credential or model change.
Per-task model overrides
Beyond a default model, a different model can be selected for specific task groups.
This is genuinely useful. Extraction over a long regulatory document and drafting a short exception justification have different cost and capability profiles, and there is no reason to use one model for both.
An empty override for a task group means "use the default model", which is also how absence is stored.
What is never exposed
Provider internals and key material stay hidden
The tenant-facing configuration deliberately excludes:
- API key material — only the last few characters of a configured key are shown, so an administrator can confirm which key is set without seeing it
- Provider endpoint URLs and probe internals
- Authentication internals from the provider registry
The provider catalogue presented to tenants is a projection: a friendly label and the available model list, never the registry entry itself.
See Secret Handling Principles.
What AI configuration does not change
Changing the provider or model changes how AI drafts and suggests. It changes nothing about governance:
- AI-produced records still enter as
proposed,draftorcandidate - Approval still requires a different person
- Deterministic evaluation is unaffected — no model participates in it
- Provenance still records which provider and model produced each artefact
See AI Principles.
Permissions
| Action | Requirement |
|---|---|
| View the tenant AI summary | Access to the settings page |
| Submit a change request | Access to the settings page |
| Configure bring-your-own-key | Tenant administrator and bring-your-own-key mode |
| Test the configuration | Tenant administrator and bring-your-own-key mode |
| Use AI features | ai.use plus the AI entitlement |
The AI Settings page requires the AI Risk Intelligence entitlement; the API enforces this independently of the interface.
Example
A bank in bring-your-own-key mode.
| Setting | Value |
|---|---|
| Mode | Bring-your-own-key |
| Provider | Configured by the tenant administrator |
| Default model | A general-purpose model |
| API key | Configured; last four characters shown |
Per-task overrides:
| Task group | Model | Reasoning |
|---|---|---|
| Requirement extraction | A larger-context model | Regulatory documents run to 90 pages |
| Control extraction | The same larger-context model | Policy documents are long |
| Exception drafting | The default | Short, structured output |
| Incident assistance | The default | Short, structured output |
Rotation: the key is rotated quarterly. After each rotation the administrator runs the test action before the change is relied on. Provenance records on artefacts produced either side of a rotation are unaffected — provenance records the provider and model, not the credential.
What compliance users see: the provider label, the model name, and a note that configuration is administrator-managed. They can submit a change request; they cannot see or change the key.
Troubleshooting
"I am a tenant administrator but cannot configure AI." The tenant is in hosted mode. Configuration is platform-managed.
"AI features stopped working after a key rotation." The rotation was applied on one side only. Update the configuration and run the test.
"A per-task override has no effect." An empty override means "use the default". Confirm the override is set for the correct task group.
"AI Settings is not visible." Requires the AI Risk Intelligence entitlement.
"Where is the API key?" It is never displayed. Only the last few characters are shown, to confirm which key is configured.