Tenant-level configuration. Editable fields are gated on the workspace.settings.update capability and write an audit-log row on every change.
Surface chrome (logo, brand colour) and tenant defaults that seed new projects. Per-project overrides win — these are the fall-back.
Nightly auditRetentionPurge worker deletes audit_log rows older than this window. Floor is 30 days (CHECK constraint tenants_audit_retention_days_min). Default 2555 days (~7 years).
Per-tenant opt-in for the assistant. When OFF, every assistant call from this tenant throws a disabled chip before reaching Anthropic — no spend, no audit row except the toggle itself. The platform env var ASSISTANT_ENABLED is a higher-priority kill switch that closes the gate for every tenant in one move.
Four Anthropic guardrails enforced by the preflight check in packages/assistant. The three dollar caps aggregate spend across windows (migration 0080); the max-tokens cap is a per-call hard-stop that blocks a single runaway prompt before it can burn the daily allowance (migration 0089). A 0 dollar cap means the assistant is disabled for that scope.
Anthropic bills in USD; AUD figures shown are approximate at a note rate of 1 USD ≈ 1.55 AUD. The ≈ AUD figures below each USD total are informational only; the preflight cap check compares USD to USD.
Last 7 UTC days: 0 requests · average $0.00/day · projected $0.00 over a 30-day month. Use this to size caps without guessing.