AI 0.1.95 / Configuration
Access policies and usage limits
Control who may use AI and how much provider capacity each actor may consume.
Choose an audience
AI access can be disabled, administrator-only, signed-in, or public. Begin with administrator-only. Test a normal member and signed-out visitor before widening the policy; an administrator session cannot prove the public boundary is correct.
The terminal hides unavailable commands and the server repeats the same access check at dispatch. A manually crafted request cannot bypass the saved policy.
Set bounded usage
Configure maximum prompt length, output tokens, cooldown, daily site requests, and per-user requests. Use conservative values first and raise them after observing actual provider cost and latency. Anonymous usage is grouped through a privacy-preserving actor boundary rather than a durable user profile.
When short context is enabled, also limit the number of retained turns and its expiration. Context is stored in expiring WordPress transients and can be cleared immediately with ai-reset.
Verify the policy
Run ai-status as an administrator, member, and guest. Confirm each actor sees only safe readiness information and the correct limits. Exceed the cooldown and one test quota deliberately; the request should be denied before contacting the provider.
External provider quotas still apply. A local allowance does not guarantee provider capacity, and a Pro fallback is attempted only for classified retryable failures.