Rhythm 2.0 Specifications

Appearance

CAP-PFM-LLM-014Provide temporary AI capacity and revoke it

Markdown

CAP-PFM-LLM-014

Provide temporary AI capacity and revoke it

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationPartially observed

Planning

Feature
FEAT-PFM-LLM-05
Exercised by
FAS-PFM-LLM-05-01, FAS-PFM-LLM-05-02, FAS-PFM-LLM-05-03, FAS-PFM-LLM-05-04, FAS-PFM-LLM-05-05
Key concepts
CON-PFM-LLM-003
Actors
ACT-PFM-004, ACT-PFM-007
Journeys
JNY-PFM-LLM-003
Depends on
CAP-PFM-LLM-007
Related
CAP-PFM-LLM-011, CAP-PFM-LLM-012, CAP-PFM-LLM-013
Proved by
ATS-PFM-LLM-014

Implementation

Executable suites
TST-PFM-LLM-008, TST-PFM-LLM-010, TST-PFM-LLM-015, TST-PFM-LLM-019, TST-PFM-LLM-026, TST-PFM-LLM-029, TST-PFM-LLM-038, TST-PFM-LLM-039, TST-PFM-LLM-071

KindCapabilityProduct areaPlatformModuleAI Requests, Usage and the Jazz AI TeammateRevision1

Read atservices-platform ad3f6a65react-console baf6dae3

Provide temporary AI capacity and revoke it ​

Purpose ​

Let managers restore or exempt AI work for a stated period with an auditable reason.

How It Works ​

A manager chooses additional credits or an exemption for one operation. Platform validates the grant window and checks the peak effective allowance over overlapping grants. Preview exposes the proposed position without storing a grant. A successful grant retains its reason, actor and any ticket reference alongside a widening audit event. Admission evaluates the grant’s active window directly. Managers revoke rather than edit grants so the original authorization remains visible. An optional capacity email applies only when the grant restores a stopped organization. The management API exists, while the console action remains disabled.

Relationships ​

  • Admit AI work against the organization’s monthly allowance supplies the prerequisite behavior for this outcome.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Temporary grants can restore admission capacity.The grant window determines when capacity applies.Revocation preserves the original grant and records withdrawal.
Surfaces
apiconsole
Preconditions
An existing organization is selected.
Postconditions
Grant and revocation writes include their control audit.
Constraints
The console grant and revoke controls are incomplete.
Intent sources
services-platform:docs/proposals/llm-observability/11-decisions.md#D-3services-platform:docs/proposals/llm-observability/11-decisions.md#D-4

Controls

29 controls apply, from the corpus control catalogue.

TC-AVL-004 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-IAM-003 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-002 TC-PI-003 TC-PI-004 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Permissions

KeyChecked atScope
hq.llm-usage.manageapiglobal
hq.llm-usage.manageconsoleglobal

Business Rules

12 rules, 9 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
Grant, preview and revocation require the sensitive HQ usage manage key, excluding read-only staff and customer administrators; customer administrators also cannot list HQ grants.
proved by ATS-PFM-LLM-014-01, TST-PFM-LLM-008
permissionapitest
services-platform:modules/llm/tests/e2e/llm-overrides.e2e.spec.js#is refused the grant before a handler runs, whatever the customer’s scope grants
02must prove
Proposed
Additional-credit grants accept one to one million whole credits, while an operation exemption names one declared operation and carries no credits; invalid kinds, fields or values are rejected.
proved by ATS-PFM-LLM-013-10, ATS-PFM-LLM-014-02, ATS-PFM-LLM-014-15, TST-PFM-LLM-008, TST-PFM-LLM-026, TST-PFM-LLM-029, TST-PFM-LLM-071
validationapi, serviceobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
03must prove
Proposed
The default grant begins now and ends at the next local month boundary; explicit windows must end after their start, end in the future and span no more than ninety-two days.
proved by ATS-PFM-LLM-014-03, ATS-PFM-LLM-014-11, ATS-PFM-LLM-014-12, ATS-PFM-LLM-014-14, TST-PFM-LLM-010, TST-PFM-LLM-015, TST-PFM-LLM-029, TST-PFM-LLM-039
validationserviceobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
04must prove
Proposed
Grants require a trimmed reason of one to five hundred characters and accept an optional ticket reference of at most two hundred.
proved by ATS-PFM-LLM-014-04, TST-PFM-LLM-029
validationserviceobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
05must prove
Proposed
At every instant in a new grant window, base allowance and overlapping unrevoked capacity must fit under the one-thousand-dollar ceiling; sequential grants are separate and per-organization decisions are serialized.
origin: services-platform:docs/proposals/llm-observability/11-decisions.md#D-3
proved by ATS-PFM-LLM-014-05, TST-PFM-LLM-029
calculationservice, databaseobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
06must prove
Proposed
The grant and widening audit event commit together with reason, ticket and window, while invalid grants write neither.
proved by ATS-PFM-LLM-014-06, TST-PFM-LLM-029
invariantservice, databaseobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
07must prove
Proposed
Revocation retains the original grant values and records actor, time and reason with a non-widening audit event; ended or revoked grants reject another revocation, and foreign grants are not found.
proved by ATS-PFM-LLM-007-17, ATS-PFM-LLM-011-11, ATS-PFM-LLM-012-08, ATS-PFM-LLM-014-07, ATS-PFM-LLM-014-13, TST-PFM-LLM-019, TST-PFM-LLM-029, TST-PFM-LLM-038
lifecycleservice, databaseobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
08must prove
Proposed
When requested, a grant that restores a stopped organization emails its administrators after saving; a grant that restores nobody sends no message.
origin: services-platform:docs/proposals/llm-observability/11-decisions.md#D-4
proved by ATS-PFM-LLM-014-08, TST-PFM-LLM-029
policyserviceobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
09must prove
Proposed
Preview uses grant validation and projects current and granted capacity, remaining credits, restoration and the peak allowance without creating records.
proved by ATS-PFM-LLM-014-09, TST-PFM-LLM-029
calculationserviceobserved
services-platform:modules/llm/services/overrides/allowance-overrides.ts
10
Proposed
Submitting the same grant twice creates and audits two grants, while a repeated revocation is refused.
policyservicedocumented
services-platform:docs/llm.md#Overrides
11
Proposed
A failed capacity notice is logged and counted without retrying or undoing the grant.
policyserviceobserved
services-platform:modules/llm/services/notices/override-notice.ts
12
Proposed
Usage managers see a disabled Grant Override control in the console with an unavailable label.
permissionconsoleobserved
react-console:components/console/hq/tenant-ai-usage-card.tsx:663

Scenarios

IdGivenWhenThenProvenance
01The base allowance cannot admit another request.An active grant adds enough capacity.Admission succeeds with the grant included.test
services-platform:modules/llm/tests/integration/services/overrides/allowance-overrides.integration.spec.js#lets the ledger admit a call the base alone would refuse
02A saved grant is active.An administrator revokes it with a reason.Revocation removes its future capacity and appears beside the grant in the audit.test
services-platform:modules/llm/tests/e2e/llm-overrides.e2e.spec.js#audits the revocation as a non-widening action beside the grant

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software