Controls

The organisation sets, for each Octy™ profile, who may ask it, from which networks and websites, how often, and the maximum monthly model spend. Controls are checked on every request before any work is done, and a refused request incurs no cost.

Controls

Control	What it does	Status
Sign-in	Staff and customer profiles answer only people signed in through the organisation’s identity provider	Built
Rate limits per person	A limit per minute and per day for each person	Built
Allowed origins	The websites from which the widget may call Octy	Built
Spend cap	A daily and a monthly cap in the deployment, and a monthly Octy limit in LightHouse™	Built
Rate limits per profile	Per visitor, per session and overall, with separate limits for answers that use a model, and a limit on model steps per answer	Built
Address allow and deny lists	The networks from which a profile may, or may not, be asked	Built
Allowed pages	The pages of a website on which the widget may appear	Built
Bot check	A check that a visitor is a person before an answer uses a model; always on for a public audience	Built
Monthly cap per profile	A hard cap on the profile’s model spend, with an alert before it is reached	Built

The order of enforcement

Controls set per profile on the Octy profiles page, enforced in this order by the service that answers the profile.

1. The profile is live

   : an unknown profile is not found; a paused one is unavailable

   Otherwise: Unavailable

   the request ends

2. The address

   : the deny list, then the allow list

   Otherwise: Refused

   the address is not allowed

3. The origin and the page

   : a listed website, and a page path the profile allows

   Otherwise: Refused

   another website or another page

4. The rate limits

   : per visitor, per session, then for every visitor together

   Otherwise: Wait

   the visitor receives a notice to try again later

5. Retrieval (no model)

   : the profile's knowledge, within the caller's access

6. For a model answer

   : the model limits, the bot check, then a reservation against the monthly cap

   Otherwise: Retrieval only

   with the cap reached, Octy answers from the passages, or states that the question is not covered

7. The router (a model call)

   : the cheapest model that meets the bar, for at most the profile's model steps

Every request passes these checks in order, before retrieval. The last three apply only when the answer needs a model, and a question answered from retrieval alone does not reach them. The first refusal ends the request.

For an Atlantic-hosted profile, the same address, origin and per-address minute limits are also applied at Atlantic’s edge, before a request reaches LightHouse. The edge limits are no stricter than the service’s. A request that the edge cannot check is passed to the service, and the service’s checks are authoritative.

Rate limits

A profile has limits per minute, per hour and per day:

• per visitor, identified by a keyed hash of the address, held in memory only and not stored;
• per session, for a visitor who keeps a session;
• for every visitor together, per minute;
• for answers that use a model, separately per visitor, per session and overall. Answers from retrieval alone do not count towards these limits;
• model steps per answer: the maximum number of models the router tries for one answer. See The router for every profile.

A visitor over a limit receives a notice to wait, and no model is called. Each tier has default limits, which a client_admin can adjust within fixed ceilings. The figures are in the client documentation.

For staff and customer profiles in a client deployment, the deployment’s own per-person limits per minute and per day also apply.

Address allow and deny lists

An allow list of networks, in CIDR form for IPv4 or IPv6, restricts a profile to the listed networks, for example an internal profile reached only from office networks and VPN. An empty allow list allows every address. A deny list excludes networks, and takes precedence over the allow list.

Allowed origins and pages

Allowed origins are the websites that may call the profile from a browser, each exactly as https://host or https://host:port. A wildcard is refused. The widget channel requires at least one. Cross-origin requests are answered only for the listed origins.

Allowed pages are the page paths on those websites where the widget may appear, such as /help/* or /policies/**: * matches one segment of a path and ** any number. An empty list allows every page. The widget hides itself on other pages. The service refuses a question from any page not on the list, independently of the widget. See The website widget.

The bot check

The bot check is a Cloudflare Turnstile check that a visitor is a person, made before a question may use a model. It is always on for a profile with a public audience, and can be turned on for any other. A visitor who has not passed it can still search the knowledge. A question that would call a model is refused until the check is passed.

The monthly cap

Each profile has a monthly cap on its model spend, in euro, and an alert at a configured percentage of the cap. Before each model call, the cost of the call is reserved against the cap; concurrent questions cannot exceed it. When the cap is reached, Octy answers from retrieval alone until the end of the month and states this in the answer. Test answers count towards the cap.

The deployment’s own caps and LightHouse’s monthly Octy limit, set in Limits by a client_admin, apply above every profile’s cap. See Limits and alerts. The gateway’s kill switch, outside the agent, stops every model call at once. See Engine and gateway.

Sign-in

Staff and customer profiles verify each person’s sign-in token from the organisation’s identity provider (Entra ID, Okta, Google, Keycloak or any OpenID Connect provider) before answering. A deployment published through an edge sign-in, such as Cloudflare Access, can use the edge’s token instead. The person’s groups determine the classes of document the person may read. See Knowledge and boundaries.

What Octy always refuses

Regardless of profile settings, Octy refuses the following requests immediately, before any model is called:

• approve, reject or sign off anything;
• pay, transfer, refund or release a payment;
• grant or change access, roles, keys or passwords;
• change a limit;
• send content to an outside address.

The refusal uses fixed wording and links to LightHouse, where a person can act. A request for work is handled separately: Octy can raise it to an agent as an approval card. See Octy and agents.

After an answer is written and before it is sent, sentences that claim a verdict, a guarantee or a certification, or that state that Octy approved, paid or sent something, are removed. Links to hosts the profile does not allow are removed.