01 · One door out
Every model call leaves through the same engine.
The assistant has many agents but a single path to an AI model.
Each call carries a label that names the kind of work
(review_mr, analyse_manifest,
chart_upgrade…). The label decides which profile the
call uses. The profile decides which endpoint the call goes to.
A test suite guards that door. If new code talks to a model provider
directly, the build fails until someone classifies that code.
02 · Classify what is in the prompt
Redact, pseudonymise, or pass. Rules decide, not a model.
Before anything leaves, a rule pack in code sorts the prompt into
data classes. No AI model classifies the prompt, because the payload
would have to leave first.
- Redact: secret material. A separate, older secret scrub handles the paths that can carry it. A fail-closed check (it blocks when unsure) backs it up on every write to your forge.
- Pseudonymise: your company and project names, public hostnames, private IP addresses, email addresses, cluster ids, Vault mount paths.
- Pass: Kubernetes kinds and label keys, public chart and image names,
cluster.local, upstream documentation hosts.
03 · Where is it going?
Destinations are declared, never inferred.
Config declares every profile as one of three destination classes.
A self-hosted box that you run is local controlled: no third
party sees the data. A provider that you accept for masked payloads
is approved remote. It can be a regional provider or a
frontier model. Anything not declared is denied.
The assistant does not trust the endpoint URL as evidence. It
refuses a profile that the declaration does not list. It does not
guess.
04 · What does the tenant require? In development
Each tenant states its own floor.
A tenant's egress requirement is one of any,
pseudonymised or local_only. The checks
are built, but not every call reliably records its tenant yet.
Until it does, a shared engine applies the strictest configured
requirement to every call. So one cautious tenant raises the floor
for all.
pseudonymised lets a call reach an approved remote
provider only as a validated masked envelope.
local_only keeps the call on your own hardware.
05 · Mask the identifiers
Same shape, obviously fake, consistent within the request.
Each identifier becomes an alias that keeps its grammar. A hostname
stays a valid hostname under the reserved .invalid
domain. A private address becomes a documentation-range address with
the same prefix width. The same value always gets the same alias. So
the model can still reason about "this host talks to that host".
The assistant stores no table of real names and aliases. It rebuilds
the mapping for each request from what the request contains.
06 · Restore on the way back
The answer comes back in your terms, or not at all.
The assistant swaps the aliases in the reply back to the real values
before any other code sees them. It rejects the reply if an alias
cannot be restored. It also rejects the reply if an alias would end
up in a file, an MR or a tool argument. So a fake name never leaks
into your repository.
A model may use a masked lane only after a paired run proves that
its replies restore cleanly. The evidence applies to that exact
provider, endpoint and model.
07 · When the only allowed endpoint is down In development
It stops and asks. It does not quietly go elsewhere.
A profile can fall back to another tier when an endpoint fails. The
assistant checks every fallback again against the policy of the tier
it lands on. It never reroutes automatically to a different
residency.
If a local_only tenant's box is down, the engine
enters a named HALT state and waits for a person. The
design accepts the cost of a lost night of work. It never sends that
tenant's data to a cloud model.
08 · Mix and match
Route each class of problem to the model that suits it.
A profile maps call labels to endpoints. Bulk, high-volume
work goes to a small, cheap model. Careful generation of a diff goes
to a stronger model. The review of the finished MR goes to a model
from a different family. So the reviewer does not mark its own
homework.
Unmapped labels use the profile's default. If a mapping names a
profile that does not exist, the assistant reports it at startup.