Where AI is used
The AI coach
The coach is an in-product assistant for HR users: it helps compose a message, explains what a screen is for, suggests how to fill a form, and improves a prompt before it is run. It has a learning cycle that can be triggered on a schedule. Its answers are grounded in what the asking user is permitted to see. It is not a back door around the permission model.Model configuration
Every AI feature is a named entry in one central configuration. Call sites never hardcode a model ID — that is enforced in CI. Models are resolved in this order:1
Per-feature environment override
AI_MODEL_<FEATURE_KEY> — for example AI_MODEL_SEMANTIC_SEARCH_REASONING. Swaps
or rolls back one feature’s model without a deploy.2
Legacy variable
LLM_MODEL and CERTIFICATE_LLM_MODEL still win over the default for the features
that honoured them before, so existing deployments keep their pinned models.3
The right-sized default
Right-sizing
Models are matched to the work rather than defaulting to the largest available:Providers and data flow
Content is sent to these providers when a feature runs. Which features are enabled is a
per-installation decision, and each customer is the data controller for their own
instance.
Auditing
Every AI operation is audited withaction: "AI_OPERATION", including token usage in
the metadata. There is a record of what was sent for processing, when, and by whom —
which is what a data-protection enquiry actually asks for.
Turning AI off
FEATURE_AI_FEATURES=false disables the AI surfaces; FEATURE_SEMANTIC_SEARCH=false
disables semantic search specifically. An installation that does not set the provider
keys has no AI features regardless of the flags.
What applicants are told
Consent, opt-out, no cut-off scores, and the transparency notice.