AI Gateway

The AI gateway is the account-level entry point for AI access and metering — individuals and organizations each configure their own connections and models, set a default model, and meter their AI usage.

Personal vs Organization

• Personal gateway — configure your own connections and models on Account → My AI (one connection hosts many models, see Model Providers), and set a personal default model for each role (agent / completion); a Use platform AI toggle (the platform fallback) lets requests fall back to the platform default model when you have no model for a role, billed by usage (deducted from your plan balance if you have one).
• Organization gateway — configure the org's shared connections and models (effective for org members) on Org view → Org AI Gateway, and set an org default model, with the same platform fallback toggle. An org's model usage is aggregated on Org Model Usage.

Resolution order

A request's selectable catalog depends on the current context: the personal view = your personal models + platform models (folded in only when platform fallback is on); the org view = that org's models + platform models (also gated by platform fallback). Personal models are visible only to you; org members see the org tier and never another member's personal models.

Within that catalog, the model actually used resolves as:

1. Your explicit pick — it must be in the catalog above, otherwise the request is rejected (no silent downgrade).
2. With no explicit pick, fall back in order: last pick (preference) → own default → platform default (gated by platform fallback).
3. If a completion role still has none, fall back to the same chain for the agent role.
4. Still none → the request fails (fail-closed).

The model used for the platform fallback is configured by platform admins under Model Providers.

End-user model selector

When you start a diagnosis or a terminal copilot, or use terminal command completion, the control end shows a model selector:

• It lists the models selectable in your current context, each showing the model name, its price (at least the input / output unit price, from AI model prices), an image input / text only capability label, and your current balance.
• Diagnosis / terminal copilot use the agent role; terminal command completion has its own selector (labeled "Completion model") on the completion role, so it can pick a different model than agent.
• Your choice is remembered — kept per context (a separate memory for the personal view and for each organization) and pre-selected next time.
• It appears only when connected to a manager: when the control end talks to the open-source signaling server (which has no multi-model capability), the selector hides and the flow falls back to the server's default model.

When diagnosis includes a screenshot, the current agent model must be declared image-capable. The control end prompts you to switch models or turn off the screenshot, and the server checks again both before collection and immediately before sending an image. Screenshot access still requires operator authorization and the host's local collection policy. At most one image is retained temporarily for recovery while the current turn is active; after settlement it becomes a text placeholder and historical REST responses never redistribute the original image.

Relation to Model Providers

• Model Providers (admin, platform-level): which connections and models the platform provides, plus the platform default model.
• AI Gateway (account-level): per-user / per-org connections, models, defaults, and metering on top of platform capability.

Usage Metering

The gateway meters token usage as one basis for billing and cost attribution. The audit side records only content-free metadata summaries — see AI Audit.

Command Execution During Diagnosis

In the personal view, a device owner can let the diagnostic agent request commands during the same conversation. The server first applies the blocklist and execution mode. Every free-form command is displayed as Critical and requires the owner to inspect the complete shell and command and explicitly approve that one request. The model cannot approve its own request or lower the server-assigned risk.

The same owner-interactive path is available through the open-source signal / Portable mode. Organization members acting on somebody else's device and Fleet batch execution do not inherit this exception; Fleet remains template-only.

Related

• Platform model access: Model Providers.
• Per-model pricing: AI model prices.
• Org usage: Organizations & Members.