Settings
Org configuration β grouped in tabs; every change is saved to the database.
π’ Organization name β
π Reset cycle β
Provider billing is monthly β allocation runs show this month vs funded so weekly slices reconcile against the monthly invoice.
π± Credits & allocationthe global defaults β per-provider values above override them
Credit unit (default) β
Allocation step β
β 10,000 tokens per click. Managers' buttons now show Β±10.
ROI pricing β
New seat defaults β
Grant a seat β auto-gets β60 now.
π‘ Policy & guardrailsenforcement, visibility and who may move credits
Enforcement β
β Gateway is in MOCK mode. The console demo works, but no real employee AI traffic is intercepted yet β minting a key won't enforce anything live. To go live: add provider keys to
.env, set LAB_GATEWAY=litellm, run docker compose up -d β then mint keys for everyone with the Mint for all seat-holders button on Gateway Keys (or headless: docker compose exec console node --import tsx lab/web.ts --mint-all-seats).β½ Reserve (fuel light) β
π Pool visibility for staff β
Identity source β
Only Entra and CSV do anything today — the others are disabled rather than pretending. Export a roster from them and import it as CSV.
π€ Peer credit transfers β who may send credits wallet β wallet
Admins can always move credits. This only limits employee/manager peer gifts & sends.
π Gatewayadd-ons, machine setup and app pools
π Gateway add-ons
mock gatewayThese four govern the lab AI command line, which this install does not serve. What decides each one on live traffic is stated per row β none of them is a switch here.
Exact cache (Redis) premiumβ
Not a switchLive traffic: the gateway caches.
litellm_settings.cache: true in install/litellm-config.yaml β this console cannot turn it off.β‘ Cache marker premiumβ
Not a switchDisplay flag for the lab AI command line only. The gateway returns its own cache headers to the caller.
!fresh bypass premiumβ
Not a switchThe
!fresh prefix exists only in the lab AI command line. For live traffic, cache behaviour is the gateway's β install/litellm-config.yaml.Smart model routing premiumβ
Not a switchNot shipped for live traffic:
install/litellm-config.yaml configures no router. Each call is served by the model the caller asked for.Per-user limits & budgetsβ
Mock gatewayNot in effect β the gateway is in MOCK mode, so no real employee traffic passes through it.
Real-time attributionβ
Mock gatewayNot in effect β the gateway is in MOCK mode, so no real employee traffic passes through it.
Configured in the gateway, not here
These are settings of your LiteLLM gateway (
install/litellm-config.yaml), not of this console β so there is no switch for them here.Provider fallbacks
litellm_settings.fallbacks β deliberately unsetNot shipped, on purpose: an OpenAI request must never be silently served and billed by Anthropic (or the reverse). That spends one provider's credits on another β breaking "credits are NOT fungible between providers" β and bills a person who holds no seat there. Per-key model scoping, set at mint, enforces the same rule.
Semantic cache
litellm_settings.cache_params.type: redis-semanticNeeds an embedding model. Set the cache type, similarity threshold and embedding model in the gateway config; this console neither enables nor measures it.
PII guardrails
guardrails: presidio-pii (mode: pre_call)Runs in a Presidio sidecar beside the gateway and is configured there. Nothing in this console scans, redacts or blocks prompt content β the console never sees prompt content.
Export to New Relic
litellm_settings.success_callback: ["newrelic"]Set the callback plus NEW_RELIC_LICENSE_KEY on the gateway container. The console exports metrics nowhere.
𧩠Model aliases β
not checked yetThe gateway is in MOCK mode, so there is nothing behind the aliases to probe β the weekly check skips itself.
The reviewed set of model ids ships as
install/model-allowlist.txt. Nothing in this product asks a provider for its model list β no call leaves your perimeter.π₯ Employee machine setup β
Self-serve download in My Wallet
each employee can download a file with their own key
Employees can mint their own key
from My Wallet β budget auto-set to their wallet balance; spend debits their own wallet
Which tools this actually covers β
Claude Code, Codex CLI and apps on the OpenAI / Anthropic SDKs take a custom base URL + the key you issue β those route through the gateway and get hard caps and per-person attribution. Seat-subscription products (GitHub Copilot, Cursor’s bundled models, ChatGPT Enterprise) cannot be intercepted by any gateway β they stay aggregate-only: you can reconcile the invoice, you cannot cap the person. Full per-tool matrix, incl. the date each row was last proven end-to-end:
Machine-wide: the setup file writes user-level variables (Windows
Claude Code, Codex CLI and apps on the OpenAI / Anthropic SDKs take a custom base URL + the key you issue β those route through the gateway and get hard caps and per-person attribution. Seat-subscription products (GitHub Copilot, Cursor’s bundled models, ChatGPT Enterprise) cannot be intercepted by any gateway β they stay aggregate-only: you can reconcile the invoice, you cannot cap the person. Full per-tool matrix, incl. the date each row was last proven end-to-end:
docs/tool-compatibility.md in your install directory.Machine-wide: the setup file writes user-level variables (Windows
setx; Mac/Linux a managed block in ~/.zshrc + ~/.bashrc), so OPENAI_BASE_URL redirects every OpenAI-SDK app on that laptop, not just Codex. To scope it, leave the self-serve download OFF and push the variables to just the intended users via GPO / Intune / Jamf.Internal hostname Β· private CA β
Off β public hostname / Let's Encrypt. Setup files stay exactly as they are today.
π Per-key limits β
A cap is not a ceiling: the gateway approves a call against the spend recorded BEFORE it, so up to 4 requests can already be in flight when the last one under the cap is approved. Worst case = the cap + 4 x the cost of one call.
Type 0 to send no limit at all (unbounded) — an empty box leaves that limit exactly as it is, so clearing a field can never quietly drop the only bound on cap overshoot. A soft-budget warning is set at 85% of every key's budget β the console raises it; the gateway never refuses on it. The gateway is in MOCK mode, so nothing carries these values.
π€ App pools (service accounts) β
Enable app pools premium
managers can create Application pools + mint their app API keys
π Providerswho supplies the AI + what a credit is worth, per vendor
Connected providers β
| Provider | tokens per β1 | $ per β1 | API key | |
|---|---|---|---|---|
| OpenAI openai Β· openai |
from env |
|||
| Anthropic (Claude) anthropic Β· anthropic |
from env |
Removal requires typing the provider id (written confirmation) β data stays intact.
π― Provider truth & auto-trackingmatch the company pool to the real provider account; fund empty departments
π― Provider-truth reconciliation β
nightly Β· 02:45 UTCConfig completeness per provider β the nightly job runs only the β ready ones and skips the rest (never blocks the others). "Check now" applies it on demand for one provider.
OpenAI β key not set
openai
not set π» End-of-day empty-department top-up β
fund empty department pools from an abundant company pool
Anthropic (Claude) β key not set
anthropic
not set π» End-of-day empty-department top-up β
fund empty department pools from an abundant company pool
β€ Auto-sweep knobs β
Forecast + reserve run β manual, at most once per reset cycle.