AI Settings and Privacy
Administrators set up AI under Settings → AI Configuration → Edit. Changes apply to the next request. Other users see only the provider, the model, whether a key is stored and the script review mode.
If the AI settings cannot be read, the AI Configuration card says so, with the reason and Retry, instead of showing no provider. If they are saved but cannot be read back, the message says so. The provider list comes from the server; it never falls back to a built-in list.
Provider
| Provider | What it needs |
|---|---|
| OpenAI | API key. The endpoint and the model used when none is chosen come from OPENAI_BASE_URL and OPENAI_DEFAULT_MODEL. |
| Anthropic | API key. Endpoint, default model and API version come from ANTHROPIC_BASE_URL, ANTHROPIC_DEFAULT_MODEL and ANTHROPIC_API_VERSION. |
| Azure OpenAI | Endpoint URL, deployment name, API key and, optionally, API version. |
| AWS Bedrock | Region, and either access keys, the instance or task role (leave the keys empty), or an IAM role to assume. |
| Google Gemini | API key. Endpoint and default model come from GEMINI_BASE_URL and GEMINI_DEFAULT_MODEL. |
| Google Vertex AI | API key. Requests use the endpoint set by GEMINI_BASE_URL. |
| Ollama (local) | Endpoint of your Ollama server. When it runs on your network, prompts never leave it. |
| OpenAI-compatible endpoint | Endpoint URL and model; an API key when the endpoint needs one. Works with any service that accepts OpenAI chat completions. |
| Augment | Tenant URL as the endpoint and an API token as the key. |
Under the provider you can set Max Tokens (1 to 200,000), Temperature (0 to 2), Timeout (1,000 to 600,000 ms) and up to 20 Extra Headers for gateways that need them. Augment does not use Max Tokens, Temperature or Extra Headers, and AWS Bedrock does not use Extra Headers, so the form leaves those fields out for them. A value out of range is refused with a message naming the field, and nothing is saved. When an agent's answer reaches the Max Tokens limit before it is finished, the agent says the answer was cut off at that limit instead of showing part of it; raise Max Tokens and run it again.
Keys and secrets
The API key, AWS keys and session token, and extra header values are encrypted before they are stored, with the same encryption as connection passwords. They are never sent back to the browser: the form shows whether a key is stored, and saving with the key field empty keeps the stored key. Extra header values show as [stored]; leave [stored] to keep a value or type a new one. Each change is written to the audit log, naming which secrets changed but never their values.
Script review mode
- Manual: a pending approval request shows Run AI Review.
- Automatic: pending approval requests are reviewed when DB DevOps opens.
The review is told the engine of the script's target connection. It runs whenever a provider is chosen, including providers that need no key, such as Ollama or Bedrock with an IAM role.
Privacy and governance
| Setting | What it does |
|---|---|
| AI Agents Enabled | When off, every AI request is refused with AI agents are disabled by an administrator. That covers the ten agents, the IDE's AI assistant, the AI review on approvals and blast radius narratives. |
| Schema Detail Sent | Table and column names. Names and types, the default, adds the columns' types, lengths and nullability. Names, types and default values adds column defaults. |
| Excluded Tables | Table names, or schema.table, separated by commas, spaces or new lines; case does not matter. They are left out of every schema summary and foreign key list, and out of blast radius narratives together with their indexes, triggers and trigger functions. The answer says how many were left out. |
| Send Sample Rows | Off by default. When on, up to 3 rows from each of the first 20 tables in the schema summary are sent, with each value cut to 40 characters, read in each engine's own language: documents on MongoDB and Elasticsearch, node properties on Neo4j, and keys with their type and value on Redis. Excluded tables are never sampled, and an object whose rows cannot be read is named in an advisory with the reason. |
Agent behaviour
| Setting | What it does |
|---|---|
| Table Cap | 0, the default, sends every table. A number sends only that many, and the answer says how many were left out. |
| Limit Requests per User | Off by default. When on, each user can run each agent the set number of times a minute; more is refused with how many seconds to wait. |
| Reuse Answers | Off by default. When on, the same agent with the same input and the same schema returns the earlier answer for the set number of seconds, marked as cached. |
| Run Mode | Wait for every run: every run answers directly. Queue a run when the caller asks, the default: runs answer directly unless an API caller asks for a queued run. Queue every run: every run is queued. |