Models, their keys and their levers
Which model providers the organisation uses, with which keys, which ones its members pick in Work, whether the web may be searched — and how to cut what each run consumes. All of it is set by an owner.
Provider keys
An owner enters each provider's key. It is encrypted (AES-256-GCM) and injected into the engine at run time; once saved, only its last characters show. An organisation's key takes precedence over the deployment's.
Models offered in Work
An owner chooses the providers offered to members. In Work, each person picks, thread by thread, a provider and a speed — fast, balanced, deep —, never a model id: the engine's table makes the link.
Web search
The web is searched by the model's provider itself, with no third-party search engine. Off by default; once an owner allows it, each member turns it on request by request with Work's « Web » toggle.
- Goes to the provider: the request and the thread's last 3 exchanges, after the pre-call check.
- Never goes: attachments, your collections, governed knowledge, skills — the search is a separate step that does not see them.
- Checked before the call: personal data, secrets and sensitive topics, per your data-protection policy; a signal turns the web off for that request, and says so.
- Stays with you: nothing by default. « Keep » (approver) adds the page, masked, to the « External sources » collection; Ailu checks it again every 90 days.
Token efficiency
- Compact output on prose steps — never on a structured or code step.
- A context budget per agent, instead of sending it every channel.
- Compression of user content — lossy, it never touches the system prompt.
The engine applies these levers to every agent when the run starts; a run already going keeps the ones it started with. What they avoid reads in Usage, measured apart from estimated.
Not yet
SoonModels included in the seat, paid in credits rather than on your own keys: today, your tokens are billed by your provider.