Skip to main content
The AI Configuration settings control how your workspace connects to AI models and services. From here you register provider credentials, manage the model catalog, configure safety guardrails, and set up authentication profiles that tools and agents use at runtime.
  • Navigation: Settings > AI Configuration
  • Required role: Owner or Admin

​
LLM providers

The Agent Platform is provider-neutral. Agents can use models from multiple LLM providers, and you can switch between them without changing agent definitions.
  • Navigation: Settings > AI Configuration > LLM Providers
  • Required role: Owner or Admin
The page is organized into three tabs: Credentials, Model Catalog, and Project Access.

​
How model resolution works

Model configuration follows a layered approach. When the runtime executes an agent, it resolves the model through a five-level priority cascade, stopping at the first match: If no model is resolved at any level, the request fails with a clear error. The platform never falls back to a hard-coded default.

​
Fallback chains

Configure fallback models to handle provider outages or rate limits. When the primary model fails (timeout, rate limit, or provider error), the runtime automatically retries with each fallback in order. The agent receives a response regardless of which model served it, and analytics track which model was used. Configure fallback models:
  1. Go to Settings > AI Configuration > Models.
  2. Select a registered model.
  3. In the Fallback section, add one or more fallback models in priority order.
  4. Click Save.
You can also declare fallback models directly in your agent definition.

​
Context window management

The runtime automatically manages the context window to stay within model limits:
  • Tool result compression - Large tool results are compressed before being added to the conversation.
  • Prior turn truncation - Tool results from previous turns are replaced with short placeholders.
  • Conversation compaction - When conversation history grows beyond the Compaction Threshold, older messages are summarized to reduce token usage while preserving context.

​
Cost and token tracking

Every LLM call tracks token usage and estimated cost, broken down by agent, project, model, and time period:

​
Credentials

The Credentials tab lists all provider credentials registered in your workspace, grouped by provider. Each credential card shows the name, provider, creation date, and the number of models using that credential. Add a credential:
  1. Go to AI Configuration > LLM Providers > Credentials.
  2. Click + Add Credential.
  3. Enter a Name (for example, Production OpenAI), select a Provider, and enter the API Key.
  4. Click Add Credential.
API keys are encrypted at rest and never displayed in plaintext after the initial entry.
Delete a credential: Click the delete icon on the credential card. Deleting a credential disconnects all models linked to it. Those models display a No Keys status in the Model Catalog until a new credential is connected.

​
Model catalog

The Model Catalog tab lists all models registered in your workspace. Each row shows the provider, model name, model ID, linked credentials, and status. Workspace tier defaults A model becomes a workspace default only when a workspace admin selects it here for a routing tier. It must be ready, active, inference-enabled, and backed by a Workspace-shared connection. Configured models may remain without a default, and a tier default never grants project access. Defaults are one-per-tier workspace catalog metadata - they don’t grant or automatically apply project access. Each project must separately select an authorized binding in Selected models (see Project Access). For each tier (Fast, Balanced, Powerful, Voice), the panel shows the tier’s intended use, its associated operation tags (for example Fast: Extraction, Validation, Tool selection), and a Workspace default dropdown to assign a model. Below the tier defaults panel, the model table lists every registered model with its provider, model name and ID, connections, a star (favorite) icon, and Ready status. Add a model from the catalog:
  1. Go to AI Configuration > LLM Providers > Model Catalog.
  2. Click + Add Model, browse or search for a provider model.
  3. Review and configure the available model settings.
  4. Click Add to Workspace.
For more information, see supported models. Add a custom model
  1. Go to AI Configuration > LLM Providers > Model Catalog.
  2. Click + Add Model, then select the Custom Model tab.
  3. Fill in the following fields:
    Available fields in the Custom Model dialog depend on the selected model and provider - not every model exposes Temperature or Max Tokens.
  4. Click Add to Workspace.
Configure model settings: Expand any model row to view and edit its settings. Connections Shows credentials linked to this model, with connection visibility and health controls.
  • Click + Add Key to connect a credential. In the Add Connection dialog, choose one of two connection methods: Optionally check Set as primary connection, choose Connection visibility (default: Workspace-shared - the compatibility-safe default; restrict a connection only when its project allowlist is known), then click Create Connection.
  • Each connected credential is listed with its name, type (for example API Key), and whether it’s the Primary connection. Click Test to verify the connection, or the delete icon to remove it.
  • Change a connection’s Connection visibility at any time and click Save access to apply.
A model with no credentials shows No Keys status and can’t serve requests. Settings - Configure Verbosity, Temperature, Top P, Max Completion Tokens, Compaction Threshold, Tier, OpenAI API Mode, and Response Mode. Available fields vary by provider and model capabilities - for example, reasoning models show Verbosity instead of Temperature and Top P. Reasoning For reasoning-capable models, this panel runs diagnostic checks and lets you set the reasoning effort: Select the Reasoning Effort level from the dropdown to control how much reasoning the model applies before responding. Capabilities Enable supported capabilities: Default for Tier, Tools, Vision, Streaming, and Realtime Voice. Available capabilities are model-dependent - unsupported ones appear disabled. Click Save to apply changes, or Delete to remove the model from the workspace.

​
Model tiers

Tiers decouple agent definitions from specific model choices. Agents reference tiers, and the platform resolves the tier to a specific model at runtime: Project-level tier overrides: Projects inherit the workspace’s model configuration but can customize how tiers map to operations. Go to Project > Settings > LLM Configuration to override tiers per operation: Overrides apply only to the current project. Other projects continue using workspace defaults.

​
Project Access

The Project Access tab inspects and manages a single project’s model bindings and feature routing, from the same authoritative configuration used by Studio and Runtime.
  • Select the project from the Project dropdown.
  • The tab has three sub-tabs: Selected models, Feature config, and Resolution diagnostics.
Secret values and binding identifiers are never shown on this page.
Selected models Shows which workspace-catalog models this project is allowed to use.
  • Model access rollout banner - indicates whether the project uses selected model bindings only, or has unresolved legacy references.
  • Imported default model unavailable banner (when applicable) - shows a legacy project default that was imported but can’t run until its workspace model and credential are configured, tagged Project default and Workspace model not configured.
  • Selected models / Eligible models counts.
  • The Selected models list shows each bound model with its provider, connection type (for example Workspace-shared), status (for example Ready), and whether it’s the Project default. Click the X to remove a model.
  • Click + Add models to open Add models from the workspace catalog. Search, then click Add next to any workspace-shared or project-restricted connection - each entry shows its provider, connection type, and readiness (for example Not tested or Ready).
  • Use the Project default (this project only) dropdown to set which selected model is this project’s default, then click Save selection.
Feature config Controls how individual platform features (operations) resolve to a model, either by tier or by per-feature override.
  • Toggle Per-operation routing to switch between “every feature follows its tier” (off) and per-feature overrides (on).
  • Banners:
    • Some features need attention - lists features whose model binding needs a fix.
    • Model access rollout - same as in Selected models.
    • Catalog features not available for execution - lists newer catalog features not yet executable (for example: Query rewriting, Retrieval reranking).
  • Tier bindings - Fast, Balanced, Powerful, and Voice cards, each showing the feature count on that tier, a model dropdown (or No model bound), and a short description of the tier’s intended use. Each tier draws only from this project’s selected models.
  • Below the tier bindings, the full feature list is grouped by category: Each feature row shows an enabled checkbox, its name, description, and operation code; a tier-or-override control (a tier dropdown, or Override with a model to pin a specific model, plus a Why this model? link explaining the resolution); which model it Resolves to; the source it came From (for example Project default); and its Status (for example Ready).
    Overrides can use selected project bindings only.
  • Click Save feature config to apply changes.
    Select a ready model binding or repair the connection before releasing this project.
Resolution diagnostics A read-only preview of the model and credential source Runtime actually selects for each operation. Secret values and binding identifiers are never shown.
  • Choose the Resolution context to preview - for example Project working configuration, or a specific deployment (for example dev · 1.0).
  • The table lists each Operation (for example Extraction, Validation, Tool selection, Response generation) with: Click View resolution details on a row to see the full precedence trail - for example whether a Deployment override, Project feature override, Project model selection, or Workspace tier default was applied.

​
Troubleshooting

​
Model Pricing

Manage workspace-level LLM pricing overrides and inspect inherited project and platform prices.
  • Navigation: Settings > AI Configuration > Model Pricing
  • Required role: Owner or Admin
The page shows four summary counts: Pricing rows, Workspace overrides, Project overrides, and Platform defaults. Add a workspace pricing override:
  1. Go to Settings > AI Configuration > Model Pricing.
  2. Click + Add pricing.
  3. In the Add workspace pricing dialog, enter:
  1. Click Save pricing.
Workspace overrides apply to every project unless a project-specific override exists. Import workspace pricing: Use Import to bulk-load effective-dated pricing rows, previewing them before committing.
  1. Go to Settings > AI Configuration > Model Pricing.
  2. Click Import.
  3. In the Import workspace pricing dialog, provide the rows either by:
    • Clicking Choose File to upload a CSV or JSON file, or
    • Pasting JSON rows or CSV with headers directly into Import content.
  4. Optionally, check Allow overlapping windows to permit pricing rows with overlapping effective-date ranges.
    Overlapping rows can make effective-price resolution depend on the latest start date.
  5. Click Preview import to validate the rows before committing.
  6. Click Commit import to apply the previewed rows as workspace overrides.
Use Refresh to reload the page’s counts and rows from the latest data.

​
Arch

Arch is the AI Architect component of the Agent Platform. It manages the model and credentials used for agent specification generation and chat-based orchestration.
  • Navigation: Settings > AI Configuration > Arch
  • Required role: Owner or Admin
Arch page The page is organized into two tabs: Settings and Audit Logs.

​
Settings

Current source: The Current Source banner displays the active credential source and model Arch is currently using, for example Model Hub · OpenAI · gpt-5.2. Credential source: Choose how Arch authenticates with the LLM provider:
Arch works best with models that support tool calling and have large context windows.
Select model: Select the model Arch uses from the dropdown. The selected model displays its provider, model ID, capability tags, and tier. If the model hasn’t been tested with Arch, a warning appears. Generation parameters: Fine-tune generation behavior for chat and spec generation: Click Save Changes to apply updates.

​
Audit logs

The Audit Logs tab shows Arch session activity for the selected time range, including cost, error count, and a browsable session list. Summary metrics: Sessions list: The list displays all Arch sessions. Use Has Errors to show only sessions with errors, or Today to show only today’s sessions. Each session row shows the session ID, timestamp, number of turns, and current phase. Click a session to view the full execution flow in the detail panel.

​
Voice services

Voice Services manages credentials for speech-to-text (STT) and text-to-speech (TTS) providers that power voice-enabled agent interactions.
  • Navigation: Settings > AI Configuration > Voice Services
  • Required role: Owner or Admin
Voice testing requires at least one STT (ASR) provider and one TTS provider configured; any supported provider combination works. For Realtime Voice, configure a realtime model (S2S).

​
Configure a provider

  1. Go to Settings > AI Configuration > Voice Services.
  2. Find the provider you want to configure and click Configure.
  3. Enter the provider credentials in the configuration dialog.
  4. Click Save.
Configuration fields vary by provider. The following table shows an example for Google Cloud Speech:

​
BYO custom speech providers

Tenant-scoped custom STT/TTS adapters available to voice pipeline channels. Use this when you want to host your own speech recognition or synthesis adapter instead of a built-in provider. You write and run the adapter; the platform routes call audio to it.
Caller audio and transcripts are sent to the endpoints you configure below. Only register endpoints you trust.
Add a BYO speech provider:
  1. Go to Settings > AI Configuration > Voice Services > BYO custom speech providers.
  2. Click + Add provider.
  3. Enter the provider details:
  1. Configure the Speech-to-text (ASR) and/or Text-to-speech adapters (see below).
  2. Click Save.
Use the Adapter contract panel to open the STT or TTS contract while filling in URLs, so you can see what your adapter needs to implement.
Speech-to-text · ASR Streaming recognizer endpoint and optional picker metadata. Toggle Enabled to make the adapter available. Text-to-speech Streaming synthesis endpoint, languages, voices, and options. Toggle Enabled to make the adapter available.
Options entered in the JSON fields are forwarded to your adapter as-is - the adapter decides what they mean.
After saving, verify the adapter with a test call. A registered credential isn’t proof the adapter works.

​
Guardrails

Guardrails provide content safety controls for your workspace and projects. Workspace administrators can configure guardrail providers and their available scanners, while guardrail policies are configured at the project level to evaluate agent inputs and outputs against defined safety rules.
  • Navigation: Settings > AI Configuration > Guardrails
  • Required role: Owner or Admin
Guardrails page The page contains two sections: Guardrail Providers and Guardrail Policies.

​
Guardrail providers

Guardrail providers are the evaluation services that assess content against your policies. Workspace administrators can add and configure guardrail providers for use across projects. Configure at least one provider before creating policies. Project authors can select which configured providers the project can use. For more information, see Select guardrail providers. Add a provider:
  1. Go to Settings > AI Configuration > Guardrails.
  2. Click Add Provider.
  3. In the dialog, configure the provider using the Form or YAML tab.
  4. Click Add Provider to save.
Form tab fields: Configure scanners After adding a guardrail provider, workspace administrators can configure the scanners available for that provider.
  1. In Guardrail Providers, find the provider you want to configure.
  2. Click Scanners in the provider’s Actions column.
  3. In the Scanners panel:
    • Add scanners as needed.
    • Enable or disable individual scanners.
    • Set the threshold for each scanner. A lower threshold is stricter and causes the scanner to trip sooner.
  4. Click Save scanners.
Provider health monitoring: The platform periodically checks provider health. When a provider becomes unhealthy, its circuit breaker activates. After repeated failures, the circuit breaker opens and stops sending requests. After the reset timeout, it allows a test request through. When a provider’s circuit breaker is open, the platform follows the configured fail mode:
  • Fail-open - Content is delivered without guardrail evaluation. Violations may go undetected.
  • Fail-closed - Content is blocked until the provider recovers. Safer, but may interrupt service.

​
Guardrail policies

The Guardrail Policies section displays the policies configured for a selected project. Select a project from the Project dropdown to view its guardrail policies. Policies are configured at the project level and attached to guardrail providers. For information about creating and configuring guardrail policies, see Guardrail policies.

​
Auth profiles

Auth profiles store authentication configurations that agent tools use to call external services securely. Profiles are managed centrally at the workspace level and reused across all projects.
  • Navigation: Settings > AI Configuration > Auth Profiles
  • Required role: Owner or Admin
Auth Profiles page The page displays auth profiles by deployment environment. Use the Default, Dev, Staging, and Production tabs to view and manage profiles for each environment.

​
Add auth profiles

Click Add Profile. Two profile types are available:

​
Supported auth types

Auth profile credentials are encrypted at rest and never exposed in logs or agent responses.
Guardrail providers that require credentials must reference an auth profile. Raw API keys are not accepted directly in the guardrail provider configuration.

​
Use auth profiles

Once created, reference an auth profile by name in tool configurations and guardrail provider settings. The platform resolves the profile at runtime and injects the correct credentials without exposing them in agent definitions, logs, or traces. When a tool runs in the Default, Dev, Staging, or Production environment, the platform resolves the auth profile configured for that environment.