Control panel

The System Administrator's seat. Everything on the platform can be controlled from here — the live model, the outbound feeds, the import hold, the integrity checks — and none of it quietly: full control is not exemption, and every switch thrown on this page lands on the audit trail under your name.

The assistant's own controls. Enablement, grounding, guardrails, parameters and usage in one place; every switch is an audited event.

PHI RAG retrieval-tuned LLM ENABLED

Purpose: The PHI AI assistant — answers questions from the Data Store with citations, under the reader's role and purpose.
Grounding: Live retrieval over the Data Store (33,311 patients) through 8 role-scoped tools; never a raw database connection.
Guardrails: Minimum-necessary confirmation before sweeps · sensitive withholding with counts · the counts-never-lists rule · cites every source · never asserts absence from unread documents.
Runs on: The foundation model you bring (this demo: Claude Sonnet 5, panel at right)
Usage: 0 questions · 0 audited record reads · 0 psychotherapy events

Disabled = the assistant refuses to read the Data Store at all and says so; it never answers about records from memory.

Claude Sonnet 5 foundation model — demo default ON

Purpose: The language model PHI RAG runs on: reads retrieved excerpts, writes the drafted answer.
Provider: Anthropic API — the demo's model, not a requirement: a deployment brings its own LLM, registered in Model registry, under its own BAA with its AI provider.
Active model: claude-sonnet-5 (default)
Credential: API key configured (held server-side, never in the page)
Parameters: temperature 0 · bounded output · 6-turn context tail
Data terms: Receives only gate-approved excerpts per question; not used for model training under the organization's agreement.

Off = no request ever leaves for the model; the scripted fallback answers and says why. Questions audited either way.

Scripted fallback deterministic responder ALWAYS ON

Purpose: Answers from fixed logic when live model calls are off or unavailable, so the assistant degrades to something honest rather than to silence.
Grounding: Same role-scoped queries, no generative text.
Guardrails: Inherits every gate; states plainly that it is the fallback.

No switch — the fallback cannot be disabled. A platform whose failure mode is silence has a worse failure mode.

Assistant settings

Saving validates each value against its bounds and writes config.changed naming every key that actually changed.

Setting	Value	Constraint
Answer length limit assistant_max_tokens		256–4096 tokens
Active assistant model assistant_model	claude-sonnet-5	set in Model registry
Retrieval · live calls rag_enabled · assistant_live	on · on	set by the panels above
Runtime parameters — read by the code that acts on them
Sampling temperature assistant_temperature		0.00–1.00 · 0 = deterministic
Call deadline assistant_timeout		5–300 seconds
Thread context assistant_context_turns		0–20 turns · 0 = every question stands alone
Question ceiling assistant_rate_limit		1–200 live questions per hour, per visitor

Each parameter is clamped to its stated bounds on save and read back by the code that acts on it: temperature and the deadline by the model call, thread context by the number of prior turns sent with a question, the ceiling by the rate check that decides when the scripted fallback answers instead. A console setting that nothing honours is a lie told in a nice font, so none of these is ornamental — turn the ceiling down to 1 and the second question this hour is answered by the fallback, which says so.

Only changed keys are written and audited; unchanged values are left untouched.