Model provider controls
Some reviews ask for evidence that a particular provider's models can be turned off. Three layers exist, listed from the one you can see in the product to the strongest.
1 · Per-feature model selection in your workspace
Workspace settings → Models exposes one model selector for each feature that calls a model: signals, audience reactions, alerts and narrative analysis. Each selector lists Google Gemini, OpenAI and Anthropic models. The workspace's choice overrides the platform default for that feature and for its background jobs.
One feature, narrative analysis, defaults to an Anthropic model; every other feature defaults to Gemini. A workspace that wants to exclude a provider therefore sets every selector explicitly. This step is required, not cosmetic.
2 · Platform-level credential removal
Provider credentials are held in Google Secret Manager and injected into the running service. Removing a provider's credential binding means no call to that provider from any workspace can authenticate, regardless of any model setting. Kumkuat can apply this fleet-wide if you require a hard control rather than a configuration one.
3 · Audit trail per call
Every model call is recorded with the workspace, the user, the feature, the provider and the model. Kumkuat can produce, on request, a per-provider count of calls for your workspace over any period. That record is the evidence that the configuration held, not just that it was set.
provider calls
gemini …
openai …
anthropic 0
Evidence Kumkuat can supply
| Evidence | Contents |
|---|---|
| Model selector screenshot | Workspace settings → Models, showing the four feature selectors with the chosen models and the excluded provider absent |
| Per-provider call audit | The per-provider call count for your workspace over the evaluation period, drawn from Kumkuat's usage log |
| Written confirmation | A statement that the provider is deselected for every feature in your workspace and that the audit will be provided on request |
Related controls
- Web grounding in chat can be switched off per workspace so persona chat answers only from stored context. See Audience Chat.
- Connected libraries can be excluded from tagging and embedding so proprietary text is never sent to a provider unless a user submits it. See Knowledge bases.