> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AI budgets, redaction, fallbacks and cache

> Monthly AI budgets with alerts, personal data kept out of prompts, fallback chains and canaries, and an answer cache for the model calls behind answers.

Every answer, ingestion and AI search visibility check MITHUNAI makes for your organisation goes through the platform's own AI gateway. Four controls apply to those calls. Each is **off** until whoever runs your deployment turns it on, and each applies to every organisation on the deployment, measured against that organisation's own use.

This is not the [Model Gateway](https://docs.mithunai.com/gateway/overview.md) at `gateway.mithunai.com`, which carries Chat's traffic and has its own [per-key budgets](https://docs.mithunai.com/gateway/virtual-keys-and-budgets.md) and [cache](https://docs.mithunai.com/gateway/guardrails.md).

You can see what applies to you in the console, under **Settings → AI gateway**, or with [`GET /ai-gateway`](https://docs.mithunai.com/api-reference/analytics/get-ai-gateway). Owners, administrators and editors can see it; nobody in your organisation can change it.

## A policy for one organisation (Beta)

By default every organisation gets the deployment's values. On a deployment that turns on per-organisation policies, a **Platform Super Admin** can give one customer its own monthly token budget, estimated cost budget, budget mode (soft or hard), personal-data redaction setting and answer-cache lifetime. A field left blank uses the deployment's value.

* **Where.** In the staff portal, open **Customers**, choose the customer and use **AI gateway policy (Beta)**. It is on that screen only. A customer's own administrators see the result under **Settings → AI gateway** and have no route to change it.
* **It replaces the whole policy.** The form opens with the customer's current policy and you cannot save until it has loaded. A save sets exactly the fields filled in and returns every blank one to the deployment's value. Saving with every field blank removes the customer's own policy. The result shows its revision number.
* **Off by default.** While the switch is off the screen is not shown and the platform answers `404` to both calls. Access on request.

The calls are `GET /platform/ai-gateway-policy?organization_id=` to read the stored policy and `PUT /platform/ai-gateway-policy` to replace it, both behind the same Platform Super Admin check as the usage allowance.

## Monthly budget

A limit on model tokens (input plus output), on estimated spend, or both, per UTC calendar month, across every surface.

* **Alerts:** at 50, 80 and 100 per cent, every owner and administrator is emailed once, and each alert is recorded in the audit log as `ai_gateway.budget_alert`.
* **Soft** budgets only alert. **Hard** budgets also refuse every model call from 100 per cent with `429 budget_exceeded` and a `Retry-After` naming the start of next month. Answers stop, and so do knowledge ingestion and visibility checks.
* The figure is read before each call, so the call that crosses the limit finishes; the next one is refused.
* This is separate from your [monthly answer allowance](https://docs.mithunai.com/analyze/usage-and-limits.md), which counts answers.

## Personal data kept out of prompts

When redaction is on, these are replaced with placeholders such as `[EMAIL_1]` before a prompt leaves for the model provider, in your question, the conversation, and the passages retrieved from your knowledge:

| Kind | Recognised by |
| - | - |
| Email addresses | shape of the address |
| Phone numbers | `+` and 8 to 15 digits, or North American `(555) 123-4567` |
| Card numbers | 13 to 19 digits passing the Luhn check |
| IBANs | the ISO 13616 check digits |
| US Social Security numbers | `123-45-6789`, dashed only |
| UK National Insurance numbers | HMRC's prefix rules |
| India PAN and Aadhaar | PAN's format; Aadhaar's `1234 5678 9012` with its checksum |
| API keys and tokens | published vendor prefixes and private-key armour |

Email addresses and phone numbers are put back into the answer you see. The others come back as a notice such as `[card number removed]`, so they are not stored with the conversation or shown in analytics. The original values are never logged or stored by the gateway. Text sent for embedding is not redacted.

## Fallbacks and canaries

* **Fallback chain:** for a model, an ordered list of others tried when its provider fails, rate-limits or times out. An assistant that names its own fallbacks keeps them.
* **Canary:** a percentage of a model's traffic tried on a second model first, with the original behind it.

Embeddings are never routed: vectors from two models cannot be compared.

## Answer cache

When the cache is on, a question asked again within its lifetime, to the same model with the same conversation and settings, is answered from the cache without calling a provider and without spending tokens. Spacing differences do not matter; wording does. The cache is kept per organisation and never shared. It holds the answer as the provider wrote it, with placeholders rather than any redacted value. It never keeps an answer that was cut short, filtered or produced by a fallback, and never caches an AI search visibility check, which must measure what search engines say now.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.