0048. Platform data reaches models only through the instance's platform route, by data class, redacted
Status: accepted, 2026-10-30
Context
The assistant, diagnoses, deploy reviews and post-mortem drafts send what they read from the platform to model
providers: logs, error events, release configurations, diffs, journals. Those carry personal data (addresses,
e-mail addresses in logs) and sometimes secrets that leaked into output. ai routes calls across subscription
accounts and API keys by availability (0012,
0036), and consumer subscriptions come with other data terms than API keys.
People who self-host need a stated guarantee of what leaves their instance, not a habit of the code.
Decision
- Platform data is what the AI reads from the platform for any feature. It reaches a model provider only
through ai's gate, on the platform route a superuser chose:
off (the default: nothing leaves), the
instance's API-key sources (all or listed), or the instance's whole pool. A superuser may let a team use its own
pool for its own data. Platform calls use the route whatever pools a team was given, and count toward the team's
platform limit in id and its budgets.
- The gate enforces it. Platform features call only with internal keys that hold no secret and work only inside
ai; for them the gate sends only the route's model names, applies no fallback outside it, refuses anything else,
and checks every answering account against the route afterwards.
- By class. Data is
metrics, config, changes, logs, errors, code or content, declared on the
operations that answer it. The instance sets the most that may leave; a team's admins narrow it for their data.
code and content stay off until a team turns them on.
- Redacted first. Credentials, tokens, keys, private keys, URLs with passwords, e-mail addresses and public IP
addresses are replaced before anything leaves. Secret values are never read at all: operations that reveal them
aren't tools, and evidence names variables only.
- Recorded. What a diagnosis, review or post-mortem sent is kept 30 days for the team's admins; the assistant's
transcript keeps tool results as the model got them; internal keys keep no request bodies.
Consequences
- A new instance sends nothing until a superuser chooses a route; diagnoses still work from deterministic rules.
- Changing the route to send more is a critical operation (a passkey); narrowing it is low.
- Redaction of free text is never complete: the route and the classes are the guarantee, redaction the second line.
- ADR 0036's grants don't decide access to the route; its member access still bounds a person's assistant use.
- Design:
superpowers/specs/2026-10-30-assistant-design.md in this repository.