SC26AI agents lab + dinner on the river · Nov 17
Parallel Works
View as Markdown
Share:

Platform Setup for AI Providers

Requiresplatform:admin

Platform administrators decide which organizations can use AI and which provider types users can connect to. Both are set in the Admin area under Products > AI. Until AI is enabled for an organization and at least one catalog entry is enabled, its users can't add providers.

The Products page shows the AI product's state (Ready, Setup required, or Attention needed) along with how many organizations, connections, and models it has. Click Configure to open it.

Platform Availability

Under Platform availability, choose who can use AI:

  • Allow all organizations: every organization on the platform can use AI.
  • Restrict organizations: only the organizations listed under Assigned organizations can use AI. Use Add an organization to add one.
  • Product disabled: AI is unavailable platform-wide.

Click Save to apply the change. Disabling AI, or removing an organization, suspends the affected connections and their configured models rather than deleting them. Credentials, conversations, permissions, catalog entries, and historical usage are kept, and restoring access restores eligible connections.

Effective access also requires an enabled catalog entry, a model enabled on the connection, and a permission grant to the user or one of their groups.

Provider Catalog

Under Configuration, click Provider catalog. The Provider access setting controls the built-in entries:

  • Allow all providers: users can connect to any built-in provider.
  • Restrict providers: only the providers enabled under Built-in providers are available. Connections to other providers are suspended, not deleted.

Click Save after changing it.

Built-in Providers

With Restrict providers selected, the Built-in providers list shows every built-in entry with its endpoint and a toggle.

  • Enable or disable an entry with its toggle. Disabling an entry immediately suspends its connections and their configured models; enabling it again resumes them.
  • Configure an entry to set its Allowed models and Text-only models:
    • Allowed models: one model ID per line. Users only see and enable models on this list. Leave it empty to allow every model the provider reports. Load models from existing connections fills the list from the models current connections report.
    • Text-only models: models that reject image input, so clients skip sending them images.

The entry's endpoint, protocol, and TLS policy are maintained by the platform and can't be changed, with one exception: USAi endpoints are agency-specific, so its row reads "Endpoint set by the platform administrator". Enabling USAi opens its Configure dialog, where you enter the Endpoint origin and Endpoint path issued to your platform before you click Enable provider.

The Self-hosted session entry controls whether users can expose models from sessions. See Self-Hosted Sessions.

Each entry's tool-calling mode is part of its built-in definition. See Tool Calling & Emulation.

Custom Providers

Under Custom providers, click Add provider to register a private or internal OpenAI-compatible endpoint. See Custom OpenAI-Compatible Providers.

Connections

Under Configuration, click Connections to see every AI connection on the platform, personal and organization-owned, with its Owner, Type, Endpoint, Models, and State. A connection's state is Active or one of the suspended states:

  • Suspended · unmapped: the connection isn't linked to a catalog entry.
  • Suspended · catalog inactive: its catalog entry is disabled.
  • Suspended · product disabled: AI is disabled platform-wide.
  • Suspended · organization not assigned: its organization isn't assigned to AI.

For an unmapped connection, choose Map to catalog entry… from its row menu and pick the approved entry that matches its endpoint, or first add that endpoint as a custom provider and map the connection to it. Mapping pins the connection's endpoint and TLS policy to the entry; ownership doesn't change.

Choose Delete connection to permanently remove a connection, its credentials, and its access grants. Managed Azure resources are deprovisioned. Historical usage is preserved.

Related Documentation