Skip to main content
Policies (Platform > AI governance > Policies) holds the rules that apply to every model call in the organization. Changes reach the LLM Gateway within seconds. The page has two cards. Policies lists access policies attached to users, groups and API keys. Settings lists the organization-wide settings this page describes: To change one, open its row’s menu and choose Change setting…, or select the row. If your role may view policies but not change them, the page shows Your role lets you see the policies, not change them. and every control is read-only. Every change is written to the Audit log with who made it.

​
License model

License model decides which ways of paying for model calls people may use. Each one has a switch: The last license model that is on stays on, and shows the note Stays on: calls fall back to it.
  • Default license model appears when both Bring your own key and Included with xpander are on. With Bring your own key, a call uses your key when one is stored for the provider, and otherwise xpander’s key, billed. With Included with xpander, a call always uses xpander’s key, billed, and stored keys are not used.
  • When someone’s plan hits its limit appears when Bring your own subscription is on. Fall back to company models (the default) moves their calls to company models until the plan resets. Pause holds their calls until the plan resets, and people can’t choose to continue.
  • Exceptions lists groups and agents that may use fewer license models than the organization.
The full order the gateway follows on every call is on Licenses and who pays. On a Hybrid install, Included with xpander is not offered for anything that runs on your install or on your people’s computers. On an Air-Gapped install, Bring your own key is the only license model, so this section does not show.

​
Key lifetime

Longest lifetime for a new API key caps the expiry people may pick for keys they create in AI models & keys: 30 days, 90 days, 180 days, 1 year or No limit. With a cap set, the key form says Your organization allows up to … and does not offer Never. Keys already issued keep their expiry.

​
Retention

Keep requests for sets how long request records are kept: 30 days, 90 days, 180 days, 1 year, or Default (90 days on xpander cloud). On a self-hosted install the last option is No limit, and records are kept until you set one. Saved text is deleted with its request.

​
Prompt and response text

Saved prompt text panel with a switch per group, all turned on

Saved prompt text: one switch per group, on by default.

Usage, cost and timing are always kept. By default, prompt and response text is kept for everyone in the account: every group, groups you add later, and people who are in no group. Saved text can include personal data, so check your privacy obligations. Open Saved prompt text in the Settings card:
  • All users in the account is the switch for everyone. Turn it off to save no text at all. While it is off, the group switches below it are held off.
  • Each group has its own switch, and every switch starts on. Turn off the switch next to a group to stop saving its text. Search with Search groups when you have many.
Turning a switch back on asks you to confirm and says how long the text will be kept.
  • Which calls. A call is saved when the person making it, or the person who started the agent run, belongs to a group with the switch on, or belongs to no group while All users in the account is on. A main account can turn saving off for all of its accounts.
  • What is kept. The prompt (instructions, the conversation and the names of the skills offered to the model) and the final answer. Keys, headers, images and files are never kept, and anything that looks like a secret is removed. Very long text is cut, with a note saying so.
  • Where and how long. The text is encrypted with a key unique to your organization and stored next to its request in your organization’s own database. It is deleted with its request after the Keep requests for period.
  • Who can read it. Anyone whose role may view usage, in the request’s Prompt and response section in Logs. Every opened request is recorded in the Audit log.
  • Turning it off. Saving stops from the next call. Text already saved stays until its request is deleted.
On a Hybrid install, these switches apply to agents in your own environment. Tools on your people’s computers connect to xpander cloud, which never saves their text.

​
Accounts

When your organization runs several accounts from a main account, License models and Saved text have an Accounts row that decides which accounts are held to the main account’s setting. Inside an account, a section the main account set shows a set by badge.