Scenario Contracted Cloud Provider as Internal

Goal: Your organization has a contract with a cloud provider, for example, a data processing agreement with guarantees on storage, regions, and training. Its models should handle confidential content like your own servers.

You need: the contract, and the provider entries of this cloud service in your configuration.

Two switches, two questions

AI Studio asks two separate questions before a provider sees confidential content, see Confidence and Data Security:

1. Data security: may this provider see content of data sources that must stay inside the organization? By default, only self-hosted providers may. With DataSourceSecuritySettings.TrustedProviderIds, you add your entries of the contracted service.
2. Confidence: is the provider trusted enough for this task, such as a local data source that requires "High", the internal wiki, or a policy with a high minimum? With a CUSTOM scheme, you give the type of the contracted service the level HIGH.

You need both. The first alone lets the provider see your ERI data sources, but not the wiki or local folders that require High. The second alone doesn't open ERI data sources with the security policy SELF_HOSTED.

The configuration

Replace <PROVIDER_KEY> with the key of the contracted provider type, as the example plugin lists them.

CONFIG = {}

CONFIG["LLM_PROVIDERS"] = {}
CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
    ["Id"] = "8d0f7e2c-6b8a-4f5e-9c9d-1e2f3a4b5c6d",
    ["InstanceName"] = "Contracted cloud model",
    ["UsedLLMProvider"] = "<PROVIDER_KEY>",
    ["Host"] = "NONE",
    ["Hostname"] = "",
    ["APIKey"] = "ENC:v2:<the encrypted key from your export>",
    ["AdditionalJsonApiParameters"] = "",
    ["Model"] = {
        ["Id"] = "<model ID>",
        ["DisplayName"] = "<model name>",
    },
}

CONFIG["SETTINGS"] = {}

-- 1. Data security: this entry counts as internal for your data sources.
CONFIG["SETTINGS"]["DataSourceSecuritySettings.TrustedProviderIds"] = {
    "8d0f7e2c-6b8a-4f5e-9c9d-1e2f3a4b5c6d",
}

-- 2. Confidence: the type gets the level of your own servers.
CONFIG["SETTINGS"]["DataConfidence.ConfidenceScheme"] = "CUSTOM"
CONFIG["SETTINGS"]["DataConfidence.CustomConfidenceScheme"] = {
    ["SELF_HOSTED"] = "HIGH",
    ["<PROVIDER_KEY>"] = "HIGH",
}

-- Keep users from adding their own accounts of this type, see below:
CONFIG["SETTINGS"]["DataApp.AllowUserToAddLLMProvider"] = false

The catch: confidence belongs to a type

The trust list names your entries, but the confidence level applies to every provider of that type. A user who adds a private account of the same service would get HIGH as well, and local data sources that require High would open to it. That's why the configuration above doesn't let users add LLM providers. If they need to, prefer an internal gateway in front of the contracted service, see Internal AI Gateway.

Check it

1. Stage the configuration on a test device, see Testing and Exporting Configurations.
2. In a chat with the contracted provider, select an ERI data source with the security policy SELF_HOSTED: the provider may use it.
3. Add a local folder as data source with the required confidence "High": the provider may use it as well.
4. Check that users can't add LLM providers.

Limits

• Review the list whenever the contract changes. Removing an entry from TrustedProviderIds takes effect with the next synchronization.
• A configuration with a higher priority that sets TrustedProviderIds replaces the list as a whole. Repeat these entries there.

Where to go next

• Configuration Scenarios
• Confidence and Data Security