AI Gateway

One place to configure which AI provider each platform feature uses, how requests are delivered, and what each feature is allowed to see.

The AI Gateway

The AI gateway is the one route by which the platform calls a language model. Each feature names a role; the gateway looks up which provider and model that role uses, applies its limits, checks AI credit where billing is on, makes the call, and writes one row to the AI run log. Changing provider is therefore configuration, not a change to any feature.

Where to find it

Architect Panel → Configuration:

AI Settings — providers, keys, the role for each feature, logging, limits and billing
Platform Modules — the AI module switch, which hides and closes the AI screens

Architect Panel → Activity:

AI Usage — cost, failures, recent calls, and a test call per role
AI Run Log — one row per call

Architect Panel → Integration & Connections:

AI Tool Access (MCP) — the opposite direction: an AI calling into the platform

Outbound, not inbound

The gateway is the platform calling a model. AI Tool Access (MCP) and Agent Access (A2A) are an outside AI calling the platform. They are different directions with different settings and different risks; see MCP Server and A2A Server.

The features that use it

The sign-up wizard (role onboarding): a description of a business becomes an app blueprint.
AI Builder (aibuilder): a request becomes a change set, shown to you before anything is applied.
App Code (ide): generates extension source, which is checked and versioned like any other code.
Report Builder's assistant (biquery): a question becomes a query definition, built from field names and labels only.
AI reading of scans (ocr): text read from scanned images for the document index.
ERP Feed Queue suggestions (erpfeed): an account and tax code proposed for an uncoded bank line, when a user asks.
Agent Access (A2A) (a2a): the planner that decides how to carry out a delegated task.
A client app's own features: any role name its developer chooses, given a provider on AI Settings.

Two more AI services sit beside the gateway and share its run log and its AI credit checks: image and video generation on Gemini, and TypeSafe Jev, a decision model that answers typed questions rather than writing text (see AI Images & Video and TypeSafe Jev).

What every call gets

A provider and model from its role, or from builder when the role names none.
Limits: features a person waits for are held to about 100 seconds a call with no retry; background work gets longer.
A credit check before anything is sent, where AI billing is on.
A row in the run log, with tokens, estimated cost and outcome, whatever happened.
A plain error code when it fails (not_configured, auth, permission, not_found, rate_limited and so on), which AI Usage explains.

Getting started

On AI Settings, enter a key and a default model for one provider.
Set the builder provider to it, so every feature inherits it.
On AI Usage, use Test on builder and check it answers.
Use the features. Watch AI Usage for a week before pointing individual roles elsewhere.

With no provider configured, every AI feature reports that AI is not configured and sends nothing.

Send to AI

The provider sections also carry Offer in Send to AI and Send to AI delivery, which govern a menu a custom app can place on its own screens. That menu can also copy a prompt to the clipboard instead of calling a provider. No standard platform screen has the menu, and the features above ignore both settings.

These are proposals, not decisions

The AI Builder's change set is shown before it runs, the Report Builder's suggested query is checked against your own permissions, and generated code goes through the same checks and approval as hand-written code. Keep it that way: the value is a good first draft quickly, and the risk begins where nobody reads the draft.

Worked example

An organisation configures one provider, sets it as builder, and tests it. A month later AI Usage grouped by feature shows App Code making several repair calls per extension, so the ide role is pointed at a stronger model, while the Report Builder's assistant, which only ever sees field names, stays on the default.

Recommendations

Start with one provider as builder and specialise roles on evidence from AI Usage.
Keep the gateway and MCP separate in your thinking: opposite directions.
Test every role you change before users rely on it.
To stop all AI calls, clear the provider keys: every feature then reports AI as not configured. The AI module switch only closes the AI screens.

Choosing a Provider

Six providers are supported, and they are not interchangeable. They differ in where your requests are processed, in what they keep, and in what the platform can do with them: some take documents as PDFs and return citations, others receive everything as one block of text and report no costs. Weigh those before model quality, which is the easiest thing to change later.

Where to find it

Architect Panel → Configuration:

AI Settings — one section per provider, and the roles table that decides who uses which

Architect Panel → Activity:

AI Usage — cost by model and service once the choice is live

Ask the questions that are hard to reverse

Where are requests processed? On Amazon Bedrock you choose the AWS Region, and the model id's prefix decides whether AWS may serve it from elsewhere in that geography or, for a global. id, from any commercial Region. For the providers' own APIs, take the answer from the provider's terms.
What does the provider keep? Retention and training use differ by provider and by contract. On Bedrock, GPT-6 requests are sent with storage switched off unless you change Let Bedrock store OpenAI requests.
Under what agreement? A business agreement and a personal plan differ enormously. Use an organisational account in every case.

Whoever signs off your data protection position needs those answers, not benchmark scores.

What each choice means on the platform

Claude, through Anthropic or through Bedrock: documents can go as PDFs, answers can cite the page they came from, token counts and costs are reported, and long answers stream.
GPT-6 through Bedrock: documents go as their extracted text, without citations. Costs are reported. From UK and EU Regions these models are offered only through their global profile.
OpenAI, Gemini, GitHub Models and Grok through their own APIs, and other Bedrock models such as Nova: reached in prompt mode. Documents go as text, there are no citations, and no token counts come back, so AI Usage shows these calls as not priced and AI billing charges them on an estimate from characters.
Gemini is also the only provider for image and video generation, whichever provider your text features use.

A stored PDF goes to a text-only route as its extracted text, which exists only once the document has been through the Document Text Extraction task. A document-heavy feature therefore works best on Claude.

Configure the default first

Every role without a provider of its own inherits builder, so the builder provider carries most of your AI traffic. Settle that choice first; pointing individual roles elsewhere then becomes tuning rather than a separate approval each time.

Choosing and switching

Write down the answers to the three questions for each provider you are considering.
Enter the chosen provider's key and default model on AI Settings, and set it as the builder provider.
Test builder on AI Usage, then use the features for a fortnight.
Group AI Usage by feature and by model to see where cost and failures sit, and point only those roles elsewhere.

Keys are credentials with a bill attached

A leaked key is somebody else's usage charged to you. Enter keys only on AI Settings, where they are never displayed again; never paste them into a ticket or an e-mail; and rotate them on a schedule. On Bedrock, give AI its own least-privilege AWS user and stop it using the platform's own AWS keys.

What goes wrong, and how to tell

A feature's answers are worse after a switch: compare Not usable for that feature on AI Usage before and after; a prompt-mode provider may fail structured answers more often.
Costs disappear from AI Usage after a switch: the new provider reports no token counts. Read its own billing instead.
Citations stop appearing in a custom feature: the role moved off Claude.

Worked example

An organisation with public-sector clients chooses Claude on Amazon Bedrock in its own AWS account in London, because the Region and the agreement can be named in a security questionnaire. It records the decision, gives AI a dedicated AWS user, and later switches on image generation, which runs on Gemini, for its marketing team only, noting in the same record that those requests go to Google.

Recommendations

Choose on processing location and terms before capability.
Get the builder provider right; it carries most of the traffic.
Prefer Claude for work over documents, where PDFs and citations matter.
Write down which providers you use and what each receives, before somebody asks.
Review the choice yearly: models are retired, and shutdown warnings appear on AI Usage first.

Using It Safely

The AI features are useful, and what they send differs a great deal from one to the next. Knowing exactly what each one sends, what the platform keeps afterwards, and who can use it lets you answer "what does your AI see?" precisely, rather than with a reassurance nobody can check.

Where to find it

Architect Panel → Configuration:

AI Settings — what the run log keeps, who may generate images, and billing

Architect Panel → Activity:

AI Usage — every call, and what the log has kept of it

Architect Panel → Security:

Document Access — documents handed over, and refused
Classification Levels — Allow Export, which decides whether a document may be sent out at all

What each feature sends

Report Builder's assistant: field identifiers, labels and the totals each field allows. Never a record value, a count or a sample row. Its reply is checked against your own permissions, and a field you cannot see is refused.
AI Builder and the sign-up wizard: your request and a description of the app's structure. An attached spreadsheet goes as a profile of its columns, which includes up to three example values per column and the distinct values of short pick-list columns.
App Code: your request and the source you are working on.
AI reading of scans: the whole image of the page, unless the document's classification forbids it leaving the system.
ERP Feed Queue suggestions: the company's chart of accounts and the bank line's text, which can include people's names.
Agent Access (A2A) planner: the request it was given, the tools it may use, and the results of the tools it has already called, which can include record data.
Image and video generation: the description and any reference images, plus a one-way code per person if the safety identifier is on.

TypeSafe Jev is a separate third-party service with its own switch; see TypeSafe Jev.

Stored documents are gated

When any feature, a custom app's or an MCP client's, hands a stored document to a model, the platform treats it as an export: the person must be able to read it, it must not be reachable only through a read-only grant, and its classification must allow export. Redacted wording is removed, or the document is refused. Every hand-over and refusal is logged. See AI Gateway for the detail.

What the platform keeps

Prompts are not kept by default (Keep the request is off).
Answers are kept, and blanked after 90 days once the housekeeping task is running.
Scans read by AI keep no text in the run log at all, only their cost.
Keys never appear on any screen or in any log.

Putting a safe position in place

List which features are in use, from AI Usage grouped by feature.
For each, note what it sends, from the list above, and which provider its role uses.
Check Allow Export on each Classification Level: off means a document at that level is never sent to a model or to an off-site scan reader.
Confirm Keep the request is off and the housekeeping task is running.
Decide who may use the features that change the app: the AI Builder is for architects unless tenant administrators are deliberately allowed, and AI Settings and AI Usage are architect-only.
Write the result down in your privacy information.

Everything is a proposal

A change set is reviewed before it runs, a suggested query is a definition you look at, and generated code goes through the same checks and approval as any other. Read change sets properly, particularly anything touching permissions, deletion or existing data: a confidently wrong change set is more dangerous than an obviously wrong one, because it gets accepted.

What goes wrong, and how to tell

Real personal data pasted into a prompt: the features are careful about what they send; a person typing is not. Use invented examples, and keep prompts out of the log.
A scan is never searchable: its classification forbids export and the scan reader is off-site. That is the rule working.
A document refused to a custom AI feature: Document Access shows the refusal and its reason.

Worked example

A client's security questionnaire asks what the AI sees. The architect groups AI Usage by feature: only the Report Builder's assistant and AI reading of scans are in use. The answer states that the assistant receives field names but never values, that scans are sent as images only where the classification allows export, that prompts are not stored, and that answers are blanked after 90 days. It takes an afternoon, because each statement can be checked on a screen.

Recommendations

Know, per feature, what is sent, and say it that precisely.
Use Allow Export on classification levels as the control for documents.
Keep prompts out of the log except while diagnosing.
Review every change set, especially the plausible ones.
Never paste real records into a prompt.

Stored Documents as AI Input

A stored document can be handed to an AI model as input: a custom feature might ask a model to check a submission pack against a checklist, and an MCP client can search documents and read their text. Sending a document to a model is treated as an export, not a read, so the same rules that stop a document leaving the system in other ways apply here too, and every hand-over is logged.

Where to find it

Architect Panel → Security:

Classification Levels — Allow Export: whether documents at that level may be sent out at all
Document Access — who was given a document, who was refused, and why

Architect Panel → Automation:

Tasks — Document Text Extraction, which produces the text most providers need

Architect Panel → Configuration:

AI Settings — Largest PDF sent as a document (bytes), in Prices, limits and retries

Who uses it

A custom app's AI features, which name a document and let the platform fetch and check it.
MCP clients, through the documents tools' search and get-text, which apply the same gate.

No standard platform screen sends stored documents to a model today. The rules below are what protects you when a custom feature or a connected assistant does.

The rules a document must pass

The person may read it, through record links, grants, ownership and their clearance.
Not only through a read-only grant. A document someone can reach only by a read-only grant is never sent.
Its classification allows export. A level with Allow Export off means its documents never go to a model.
Same tenant. Another tenant's document is treated as if it did not exist.
Redactions are honoured. A version with a live redaction never sends its file; it goes as text with every redacted wording removed, and is refused if the platform cannot show the wording is gone.

A refusal stops the request and names the reason, never the content. Each document sent, and each refused, is a row in the document access log for exactly the version concerned.

PDF or text

Claude receives a PDF as the PDF, up to Largest PDF sent as a document (bytes) (14 MB by default). A larger PDF goes as its extracted text, with a note.
GPT-6 on Bedrock and the prompt-mode providers receive the extracted text only, without citations.
Office files and plain text go as text. A small file with no extracted text yet is extracted on the spot; a larger one is queued and refused until extraction has run.
Images are never read from a document here; scanned images are read by the separate OCR route.

Text is never cut short: a document too long to send is refused, because a model shown half a document answers confidently about that half.

Making documents ready for AI

In Tasks, switch on Document Text Extraction. It ships disabled; until it runs, nothing queued is extracted and only Claude can be sent a PDF.
Review Allow Export on each Classification Level, so that nothing which must stay in the building can be sent.
For attachments uploaded through ordinary file fields, turn them into documents first; see Bringing Documents In.
After the first real use, open Document Access for the period and check the hand-overs and refusals are what you expect.

Citations

When a feature asks Claude to cite its sources, each claim in the answer can point to the document and page it came from. Whether those citations are shown to people depends on the feature that asked; no standard screen displays them today.

What goes wrong, and how to tell

A feature reports a document was refused: Document Access shows the refusal and its reason, such as the classification or a read-only grant.
"not extracted": the document has no text yet. Check Document Text Extraction is switched on.
"too large": the PDF or text is over the limit. Send fewer documents, or a smaller one.
A redacted document refused: its redaction could not be shown removed from the text, or records only a marked area. That is deliberate.

Worked example

A housing team's custom feature asks a model to check each tenancy pack against a checklist. Most packs go through; one is refused. Document Access shows the refusal: the pack's medical letter is classified at a level with Allow Export off. The team leaves the rule in place, and the checklist for that pack is completed by hand.

Recommendations

Set Allow Export deliberately on every classification level before any AI feature goes live.
Switch on Document Text Extraction wherever documents may reach a non-Claude model.
Read Document Access after go-live; it is the record of what left.
Prefer Claude for document work, where PDFs and page citations are supported.