# Controls

> The controls on an Octy profile, in order of enforcement: sign-in, rate limits, address allow and deny lists, allowed origins and pages, the bot check and the monthly cap.

The organisation sets, for each Octy™ profile, who may ask it, from which networks and websites, how often, and the maximum monthly model spend. Controls are checked on every request before any work is done, and a refused request incurs no cost.

## Controls

| Control                      | What it does                                                                                                                   | Status |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------ |
| Sign-in                      | Staff and customer profiles answer only people signed in through the organisation’s identity provider                          | Built  |
| Rate limits per person       | A limit per minute and per day for each person                                                                                 | Built  |
| Allowed origins              | The websites from which the widget may call Octy                                                                               | Built  |
| Spend cap                    | A daily and a monthly cap in the deployment, and a monthly Octy limit in LightHouse™                                           | Built  |
| Rate limits per profile      | Per visitor, per session and overall, with separate limits for answers that use a model, and a limit on model steps per answer | Built  |
| Address allow and deny lists | The networks from which a profile may, or may not, be asked                                                                    | Built  |
| Allowed pages                | The pages of a website on which the widget may appear                                                                          | Built  |
| Bot check                    | A check that a visitor is a person before an answer uses a model; always on for a public audience                              | Built  |
| Monthly cap per profile      | A hard cap on the profile’s model spend, with an alert before it is reached                                                    | Built  |

## The order of enforcement

Controls set per profile on the Octy profiles page, enforced in this order by the service that answers the profile.

1. **The profile is live**

   : an unknown profile is not found; a paused one is unavailable

   Otherwise: Unavailable

   the request ends

2. **The address**

   : the deny list, then the allow list

   Otherwise: Refused

   the address is not allowed

3. **The origin and the page**

   : a listed website, and a page path the profile allows

   Otherwise: Refused

   another website or another page

4. **The rate limits**

   : per visitor, per session, then for every visitor together

   Otherwise: Wait

   the visitor receives a notice to try again later

5. **Retrieval** (no model)

   : the profile's knowledge, within the caller's access

6. **For a model answer**

   : the model limits, the bot check, then a reservation against the monthly cap

   Otherwise: Retrieval only

   with the cap reached, Octy answers from the passages, or states that the question is not covered

7. **The router** (a model call)

   : the cheapest model that meets the bar, for at most the profile's model steps

Every request passes these checks in order, before retrieval. The last three apply only when the answer needs a model, and a question answered from retrieval alone does not reach them. The first refusal ends the request.

For an Atlantic-hosted profile, the same address, origin and per-address minute limits are also applied at Atlantic’s edge, before a request reaches LightHouse. The edge limits are no stricter than the service’s. A request that the edge cannot check is passed to the service, and the service’s checks are authoritative.

## Rate limits

A profile has limits per minute, per hour and per day:

- **per visitor**, identified by a keyed hash of the address, held in memory only and not stored;
- **per session**, for a visitor who keeps a session;
- **for every visitor together**, per minute;
- **for answers that use a model**, separately per visitor, per session and overall. Answers from retrieval alone do not count towards these limits;
- **model steps per answer**: the maximum number of models the router tries for one answer. See [The router for every profile](/octy/router/#escalation).

A visitor over a limit receives a notice to wait, and no model is called. Each tier has default limits, which a `client_admin` can adjust within fixed ceilings. The figures are in the client documentation.

For staff and customer profiles in a client deployment, the deployment’s own per-person limits per minute and per day also apply.

## Address allow and deny lists

An **allow list** of networks, in CIDR form for IPv4 or IPv6, restricts a profile to the listed networks, for example an internal profile reached only from office networks and VPN. An empty allow list allows every address. A **deny list** excludes networks, and takes precedence over the allow list.

## Allowed origins and pages

**Allowed origins** are the websites that may call the profile from a browser, each exactly as `https://host` or `https://host:port`. A wildcard is refused. The widget channel requires at least one. Cross-origin requests are answered only for the listed origins.

**Allowed pages** are the page paths on those websites where the widget may appear, such as `/help/*` or `/policies/**`: `*` matches one segment of a path and `**` any number. An empty list allows every page. The widget hides itself on other pages. The service refuses a question from any page not on the list, independently of the widget. See [The website widget](/octy/widget/).

## The bot check

The bot check is a Cloudflare Turnstile check that a visitor is a person, made before a question may use a model. It is always on for a profile with a public audience, and can be turned on for any other. A visitor who has not passed it can still search the knowledge. A question that would call a model is refused until the check is passed.

## The monthly cap

Each profile has a **monthly cap** on its model spend, in euro, and an **alert** at a configured percentage of the cap. Before each model call, the cost of the call is reserved against the cap; concurrent questions cannot exceed it. When the cap is reached, Octy answers from retrieval alone until the end of the month and states this in the answer. Test answers count towards the cap.

The deployment’s own caps and LightHouse’s monthly **Octy** limit, set in **Limits** by a `client_admin`, apply above every profile’s cap. See [Limits and alerts](/operations/limits-and-alerts/). The gateway’s kill switch, outside the agent, stops every model call at once. See [Engine and gateway](/security/engine/).

## Sign-in

Staff and customer profiles verify each person’s sign-in token from the organisation’s identity provider (Entra ID, Okta, Google, Keycloak or any OpenID Connect provider) before answering. A deployment published through an edge sign-in, such as Cloudflare Access, can use the edge’s token instead. The person’s groups determine the classes of document the person may read. See [Knowledge and boundaries](/octy/knowledge/#the-boundary).

## What Octy always refuses

Regardless of profile settings, Octy refuses the following requests immediately, before any model is called:

- approve, reject or sign off anything;
- pay, transfer, refund or release a payment;
- grant or change access, roles, keys or passwords;
- change a limit;
- send content to an outside address.

The refusal uses fixed wording and links to LightHouse, where a person can act. A request for work is handled separately: Octy can raise it to an agent as an approval card. See [Octy and agents](/octy/agents/).

After an answer is written and before it is sent, sentences that claim a verdict, a guarantee or a certification, or that state that Octy approved, paid or sent something, are removed. Links to hosts the profile does not allow are removed.

Source: https://docs.atlanticagenticlabs.com/octy/controls/