Optional AI, BYOK, and privacy

The core simulator and approved guide path operate without AI. Optional AI can help classify a pain statement or summarize a record, but its output is advisory. Evidence committed by the operator remains the source of truth.

A user-provided API key should remain isolated to the current browser session or request path according to the deployed implementation. It must not be written to local storage, analytics, logs, source control, or a public client environment variable. Never prefix a secret with NEXT_PUBLIC_.

A server-side OPENAI_API_KEY belongs in the hosting provider's secret settings. Anonymous public traffic should not inherit an unrestricted owner key by default. Use explicit policy, rate limits, usage caps, monitoring, and a server-only boundary.

Safe logs may include request ID, deployment mode, region, model name, latency, token counts, success or failure state, and redacted error category. They must not include API keys, full prompts containing customer data, raw evidence payloads, access tokens, or secrets returned by a provider.

Each request must be associated with its own session context. User A must never receive User B's key, prompt, evidence, or response. Hosted relays should avoid shared mutable key state and should redact provider errors before returning them to the browser.