Configuration Scenarios

The scenarios on these pages show complete configurations for typical needs of organizations. Each one names its goal, the building blocks, a configuration plugin you can start from, what your colleagues see, how you check it, and its limits.

The examples show only the parts that matter for the scenario. The header of a configuration plugin is explained in Writing Configuration Plugins. Create your own IDs for every configuration and every object; the IDs in the examples are placeholders.

The scenarios

Scenario	For organizations that …	Main building blocks
Local Models Only	allow no cloud service at all	Self-hosted providers, LOCAL_TRUST_ONLY, minimum HIGH, no web tools, DISABLE_UPDATES
Confidential Content on Trusted Providers	use cloud models for everyday tasks, but keep internal knowledge on their own servers	CUSTOM scheme, global minimum, ERI data sources with SELF_HOSTED, outbound restrictions
Contracted Cloud Provider as Internal	have a contract that lets a cloud service handle confidential content	TrustedProviderIds together with HIGH in a CUSTOM scheme
Organization-Provided API Keys	pay for the AI models of their colleagues	Encrypted API keys, the encryption secret, the export format during the rollout
Users Bring Their Own Keys	prepare the providers, while each person uses a personal key	AllowUserProvidedAPIKey, PromptForUserAPIKey, USER_API_KEY_PROMPT
Internal AI Gateway	send all requests through a gateway such as LiteLLM	The provider type LITE_LLM, a CUSTOM scheme, trusted entries, usage statistics
Standardized Workplace	want everybody to start with the same, prepared AI Studio	Hidden assistants, chat templates, profiles, approved plugins, mandatory notices
Your Own Web Search	let the AI search the web through their own search engine	A SearXNG instance of your own, locked tool settings, outbound restrictions

Combining scenarios

The scenarios combine well, because a device can load several configurations, see How Central Configuration Works. A common setup is a base configuration for the whole organization with the trust settings and the providers, and one configuration per department with its templates and assistants. Keep in mind that lists such as DataApp.ProhibitedProviders or DataSourceSecuritySettings.TrustedProviderIds replace each other instead of adding up.

Before you roll out

• Test every configuration on a device first, see Testing and Exporting Configurations.
• Check which version your devices run. Settings that a version doesn't know yet are ignored there, see Managing Updates.