Rhythm 2.0 Specifications

Appearance

CAP-PFM-LLM-013Set an organization’s AI access and recurring limits

Markdown

CAP-PFM-LLM-013

Set an organization’s AI access and recurring limits

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationPartially observed

Planning

Feature
FEAT-PFM-LLM-05
Exercised by
FAS-PFM-LLM-05-01, FAS-PFM-LLM-05-02, FAS-PFM-LLM-05-03, FAS-PFM-LLM-05-04, FAS-PFM-LLM-05-05
Key concepts
CON-PFM-LLM-003
Actors
ACT-PFM-004, ACT-PFM-033
Depends on
CAP-PFM-LLM-005
Related
CAP-PFM-LLM-007, CAP-PFM-LLM-011, CAP-PFM-LLM-014, CAP-PFM-LLM-017
Proved by
ATS-PFM-LLM-013

Implementation

Executable suites
TST-PFM-LLM-007, TST-PFM-LLM-016, TST-PFM-LLM-019, TST-PFM-LLM-021, TST-PFM-LLM-026, TST-PFM-LLM-036, TST-PFM-LLM-037, TST-PFM-LLM-053, TST-PFM-LLM-077, TST-PFM-LLM-079

KindCapabilityProduct areaPlatformModuleAI Requests, Usage and the Jazz AI TeammateRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Set an organization’s AI access and recurring limits ​

Purpose ​

Give authorized Rhythm staff an accountable way to change future AI admission.

How It Works ​

A manager supplies the full replacement limits and the version they inspected. Platform validates the allowance, disabled operations, concurrency cap and reason. A preview calculates the proposed effect without writing it. A changed save updates the limits and the current period’s base allowance together with its audit event. A stale changed save is refused, while a replay of already stored values makes no further change. Running requests retain their holds and finish normally. New requests use the revised access switches and allowance. The console shows the planned management control but does not yet let staff perform the change there.

Relationships ​

  • Publish AI operation definitions and historical prices supplies the prerequisite behavior for this outcome.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Configured allowance and switches apply to new admissions.Ceiling and version checks reject invalid or stale updates.Control audits retain the change, actor and reason.
Surfaces
apiconsole
Preconditions
An existing organization is selected.
Postconditions
The limits update synchronizes the current period and audit.
Constraints
The console limit controls are incomplete.
Intent sources
services-platform:docs/proposals/llm-observability/11-decisions.md#D-3

Controls

22 controls apply, from the corpus control catalogue.

TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-005 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.llm-usage.manageapiglobal
hq.llm-usage.manageconsoleglobal

Business Rules

11 rules, 9 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
The sensitive HQ AI usage manage key is required to preview or change limits; read-only staff and customer administrators are refused.
proved by ATS-PFM-LLM-013-01, TST-PFM-LLM-007
permissionapitest
services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#is refused the write before a handler runs, whatever the customer’s scope grants
02must prove
Proposed
A replacement supplies the AI switch, base allowance or default, disabled operations, concurrency cap or default and note, with omitted optional cap and note reset.
proved by ATS-PFM-LLM-013-02, ATS-PFM-LLM-013-15, TST-PFM-LLM-026, TST-PFM-LLM-037
validationapi, serviceobserved
services-platform:modules/llm/services/limits/tenant-limits.ts
03must prove
Proposed
Limit validation accepts a default allowance or a whole credit amount from zero to ten million, a default or positive whole concurrency cap, and declared disabled operations stored once in sorted order. Notes are trimmed and limited to one thousand characters; reasons are trimmed to one through five hundred characters. Invalid input leaves state unchanged.
proved by ATS-PFM-LLM-005-12, ATS-PFM-LLM-013-03, ATS-PFM-LLM-013-12, ATS-PFM-LLM-013-17, TST-PFM-LLM-016, TST-PFM-LLM-079
validationapi, serviceobserved
services-platform:modules/llm/services/limits/tenant-limits.ts
04must prove
Proposed
A changed save requires the inspected limits version, using zero for defaults, and missing or stale versions are rejected.
proved by ATS-PFM-LLM-013-04, ATS-PFM-LLM-013-14, ATS-PFM-LLM-013-16, TST-PFM-LLM-007, TST-PFM-LLM-036, TST-PFM-LLM-053
validationapi, servicetest
services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#refuses a stale If-Match with 409
05must prove
Proposed
Values identical to stored limits return unchanged without a write, new version or audit entry, even with an older supplied version.
proved by ATS-PFM-LLM-013-05, TST-PFM-LLM-007, TST-PFM-LLM-026
policyserviceobserved
services-platform:modules/llm/services/persistence/limits.ts
06must prove
Proposed
A limits save atomically updates the current month’s base allowance and audit event without rewriting charges, holds, grants or past periods; later periods use the new base when created.
proved by ATS-PFM-LLM-007-16, ATS-PFM-LLM-011-10, ATS-PFM-LLM-013-06, TST-PFM-LLM-007, TST-PFM-LLM-019, TST-PFM-LLM-026
lifecycleservice, databaseobserved
services-platform:modules/llm/services/limits/tenant-limits.ts
07must prove
Proposed
The audit event includes before and after values, reason and actor and marks allowance increases, AI re-enablement or operation re-enablement as widening.
proved by ATS-PFM-LLM-013-07, TST-PFM-LLM-026
policyserviceobserved
services-platform:modules/llm/services/limits/tenant-limits.ts
08must prove
Proposed
Preview reports proposed allowance, committed and remaining credits, limiting reason and effective-ceiling pressure without writing limits or audit events.
proved by ATS-PFM-LLM-013-08, TST-PFM-LLM-007, TST-PFM-LLM-026
calculationserviceobserved
services-platform:modules/llm/services/limits/tenant-limits.ts
09must prove
Proposed
Disabled AI rejects every operation; an active operation exemption can bypass an operation switch but never the global AI switch, and refusal records the disabled-feature reason without a hold.
proved by ATS-PFM-LLM-001-17, ATS-PFM-LLM-013-09, ATS-PFM-LLM-013-10, ATS-PFM-LLM-013-11, ATS-PFM-LLM-013-13, ATS-PFM-LLM-013-18, TST-PFM-LLM-021, TST-PFM-LLM-026, TST-PFM-LLM-077
policyservicetest
services-platform:modules/llm/tests/integration/services/limits/tenant-limits.integration.spec.js#refuses it when AI is off, whatever exemption is in force
10
Proposed
The reason belongs in the audit event and is distinct from the explanatory note retained with limits.
policyservicedocumented
services-platform:docs/llm.md#Limits
11
Proposed
Only usage managers see the console’s Edit Limits control, which remains disabled with an unavailable label.
permissionconsoleobserved
react-console:components/console/hq/tenant-ai-usage-card.tsx:639

Scenarios

IdGivenWhenThenProvenance
01An organization uses default limits at version zero.An administrator submits a reasoned allowance increase.The update advances the version, synchronizes the current period and records widening.test
services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#syncs this month’s period to the new allowance
02Two administrators use the same limit version.The second update arrives after the first.The stale update changes nothing.test
services-platform:modules/llm/tests/e2e/llm-limits.e2e.spec.js#changes nothing for a stale If-Match

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software