AI assistant deployment

The AI assistant is part of the Authorization Hub Helm chart and is disabled by default. This section describes how to enable the assistant and connect to a language model.

A language model and its credentials are not included with Authorization Hub and must be provided separately.

DATA SENT TO THE MODEL PROVIDER

To answer your questions, data from the active project, including policy content, is sent to the configured model provider. Ensure that the provider and its data handling terms comply with your organization's policy standards. For details on what data is shared, see the How the AI assistant works section."

Prerequisites

• A running Authorization Hub deployment. Read the Deployment section for details.

• Access to a supported model, with:

  • an API key
  • the base URL of the provider's API
  • the model ID

• Outbound network access from the cluster to the model provider.

Conversations are stored in the Authorization Hub PostgreSQL database, in the assistant schema, using the existing db-connection secret. No additional database is required.

Supported models

The assistant can be connected to any model that is served through an OpenAI-compatible API, supports streaming and tool calling, and has a context window of at least 128,000 tokens. Without tool calling, policies cannot be checked or tested. With a smaller context window, requests are rejected when the policy or the conversation is large. Read the Token usage and cost section for details.

An OpenAI-compatible provider offers the OpenAI Chat Completions API at its own base URL. The assistant has been tested with official OpenAI models. The default model is gpt-5.6-luna from OpenAI. To use another model, set the model ID as described in the Enable the assistant section.

The following providers are common examples. Only OpenAI has been tested. The base URL and the model ID depend on your provider and model.

Provider	Base URL	Documentation
OpenAI (tested)	https://api.openai.com/v1	ModelsOpens in a new tab, DeprecationsOpens in a new tab
Azure OpenAI in Microsoft Foundry	https://<resource-name>.openai.azure.com/openai/v1	Model lifecycle and support policyOpens in a new tab
Google Gemini API	https://generativelanguage.googleapis.com/v1beta/openai	OpenAI compatibilityOpens in a new tab
OpenRouter	https://openrouter.ai/api/v1	QuickstartOpens in a new tab
Ollama (self-hosted)	http://<host>:11434/v1	OpenAI compatibilityOpens in a new tab

For Azure OpenAI, the model ID is the deployment name.

note

Only gpt-5.6-luna has been verified. The default request options, such as the reasoning effort, are set for this model and can be rejected by other models. If every answer fails after the model is changed, read the AI assistant troubleshooting section.

Enable the assistant

1. Create a secret containing the model provider credentials.

   kubectl create secret generic model-credentials \
     --from-literal=api-key=$OPENAI_API_KEY \
     --from-literal=base-url=$OPENAI_BASE_URL

   Replace $OPENAI_API_KEY with your provider's API key, and $OPENAI_BASE_URL with its base URL. Read the Supported models section above for example base URLs.

   warning

   The base URL must include the API version path, for example /v1. Without it, every request is rejected with a "not found" error.

2. Enable the assistant and set the model ID in your deployment values.

   services:
     hubAiService:
       enabled: true
       env:
         chatModel: "gpt-5.6-luna"

3. Upgrade the Helm chart with these values. Read the Upgrade section for the helm upgrade command. The values can also be added to that command:

   --set services.hubAiService.enabled=true \
   --set services.hubAiService.env.chatModel=gpt-5.6-luna

4. Verify that the assistant is ready.

   kubectl get pods -l app.kubernetes.io/component=hub-ai-service

   The pod is reported as Ready when the model configuration is present and the database can be reached. Reachability of the model provider is not checked.

5. Sign in to Authorization Hub, open a project, and click the AI assistant button at the bottom right of the page. Ask a question to confirm that the model answers, for example "Is this policy valid?".

Helm values

Value	Default	Description
services.hubAiService.enabled	false	The assistant is deployed when set to true. A Helm upgrade is required after a change.
services.hubAiService.env.chatModel	gpt-5.6-luna	The model ID sent to the provider. Read the Supported models section for details.
services.hubAiService.env.keycloakUrl	http://keycloak:8080	The internal Keycloak URL used to validate user tokens.
services.hubAiService.resources	See values.yaml	CPU and memory requests and limits.

The following keys are stored in the model-credentials secret:

Key	Required	Description
api-key	Yes	The model provider API key.
base-url	Yes	The provider's API base URL, including the version path.

If the secret or one of its keys is missing, the assistant does not start. If a key is present but empty, the assistant starts but is reported as not ready.

Model settings

These settings apply to OpenAI-compatible providers. They are environment variables of the hub-ai-service container. The API key, base URL, and model ID are set by Helm. Read the Helm values section for details. For the other settings, a default that suits the tested model is provided.

note

The other settings are not exposed by the Helm chart. Contact Axiomatics Customer SupportOpens in a new tab before changing them.

Environment variable	Default	Description
OPENAI_API_KEY	Set by Helm	The provider API key, from the model-credentials secret. Required.
OPENAI_BASE_URL	Set by Helm	The provider API base URL, including the version path, from the model-credentials secret.
OPENAI_CHAT_MODEL	Set by Helm	The model ID, from the chatModel Helm value.
OPENAI_CHAT_REASONING_EFFORT	none	The amount of reasoning before an answer is started. Only certain values are accepted by some models. When set to an empty value, the option is left out of requests.
OPENAI_CHAT_VERBOSITY	low	The length of answers. When set to an empty value, the option is left out of requests.
OPENAI_CHAT_TEMPERATURE	1.0	The sampling temperature. Only 1.0 is accepted by GPT-5 models.

Limits

The following limits apply to conversations and answers.

Conversation limits

Limit	Value	Description
Conversation retention	2 hours	A conversation is removed after this period without activity.
Conversations per user, per project	50	When this number is exceeded, the user's least recently used conversation in the project is removed.
Conversation context	20 messages	The number of recent messages sent to the model with each question.
Message length	8,000 characters	The maximum length of a message.

Response time limits

Limit	Value	Description
First response	90 seconds	The longest wait for the start of an answer.
Pause in an answer	50 seconds	The longest pause allowed while an answer is in progress.
Total answer time	150 seconds	The longest time allowed for one answer. The answer is then stopped with a message.
Policy check	30 seconds	The longest time allowed for one step of policy checks or tests.

If a reverse proxy is used in front of Authorization Hub, its read timeout must be set above the total answer time. Read the AI assistant troubleshooting section for details.

Read the Preference limits section for the preference limits.

Token usage and cost

The model provider bills each question to the AI assistant by the number of tokens sent and received. This section gives rough estimates of token usage and cost.

note

The figures below are approximations. Actual usage depends on the size of the open policy, the number of policies and attributes that are read, the length of the conversation, the number of checks and tests that are run, retries, preferences, the model, and the provider's prompt caching. Actual usage is shown in your provider's usage dashboard.

What is sent with each question

Part	Approximate tokens
Assistant instructions and tool definitions	15,000, the same for every question
Open policy file, cursor position, and selection	Up to 9,000
Preferences	Up to 1,500
Message	Up to 2,000
Earlier messages of the conversation	Up to 70,000, in a long conversation
Policies, attributes, and test results read while the answer is prepared	Depends on the project. Not limited

The parts with a limit add up to about 100,000 tokens. Together with the data read while the answer is prepared, this is why a context window of at least 128,000 tokens is required.

How tokens add up

One answer can take several model calls, for example one call to read a policy, one to test it, and one to write the answer. The full context is sent with every call, so the input tokens of a question are a multiple of the context size.

Most of the context is the same from one call to the next. That part is usually served from the provider's prompt cache and is billed at a lower rate. When a conversation has been inactive for a while, the cache may have expired, and the next question is billed at the full input rate.

The answer is billed as output tokens. A proposed change includes the changed policy text, so a change to a large policy produces more output tokens than an explanation.

Example estimates

The estimates below use the OpenAI prices for gpt-5.6-luna in October 2026:

• $0.20 per million input tokens
• $0.02 per million cached input tokens
• $1.20 per million output tokens

Prices change. Read the OpenAI pricingOpens in a new tab page for the current prices.

Question	Model calls	Input tokens	Output tokens	Approximate cost
Explanation of a small policy, short conversation	3	75,000, mostly cached	2,000	$0.01
Change to a large policy, long conversation, with one retry	6	650,000, mostly cached	20,000	$0.07

A retry is an additional pass that is made when a proposed change was not tested or did not compile.

For example, 20 users who each ask 30 questions a day for 21 working days ask 12,600 questions a month. At about $0.01 per question, this is about $125 a month. A higher share of changes to large policies increases the cost.

Reduce token usage

• Click New conversation when the topic changes. Earlier messages are then no longer sent.
• Select the part of the policy in question instead of asking about the whole file.

Rotate the API key

1. Update the model-credentials secret with the new key.

2. Restart the assistant so that the new value is read.

   kubectl rollout restart deployment hub-ai-service

Disable the assistant

Set services.hubAiService.enabled to false and upgrade the Helm chart. The assistant service is removed from the cluster, and messages sent from the assistant panel are no longer answered. Stored conversations are kept in the assistant database schema.

Next step

If answers fail after the assistant is enabled, read the AI assistant troubleshooting section.