How Intended Uses AI#

Intended is deterministic by default. Every allow, escalate and deny decision is made by deterministic rules and your policies, and by people when a decision is escalated. Out of the box, no AI model decides, scores or influences a decision.

Intended has two optional AI features. Both are off until an owner or admin of your workspace turns them on. You can see and change them in the console under Settings → Privacy & AI.

What decides, by default#

When an agent asks to do something, Intended:

1. Classifies the action with a fixed rule set (the Open Intent classifier). The same input always gets the same classification.
2. Evaluates your policies against that classification, the risk flags and the tool-call arguments.
3. Returns allow, escalate (held for approval) or deny, and records the decision in a hash-chained audit log.

None of these steps calls an AI model. If anything fails along the way, the answer is deny. See Fail-Closed Controls.

Optional AI features#

Each feature is explained in full below.

AI-assisted classification#

What it does. Some requests arrive as plain English, such as "roll back the payments service in production". With this feature on, an AI model reads the text and proposes a structured action: what the action is, which system it targets, and risk flags such as "touches production". Intended then checks that the proposed action is on your workspace's list of allowed actions, and your policies decide as usual.

What it can and can't do. The model's output is an input to the decision, not the decision. It can change which action your policies evaluate, so it can change the outcome. It cannot approve anything on its own, skip your policies, or issue a token. If the model is unreachable or times out, or its output still doesn't match the expected format after one repair attempt, the compilation fails and nothing is authorized. There is no automatic fallback from one AI provider to another, and never a fallback to a key of Intended's: if the switch is on but no key of yours is on file, Intended does not call a model at all. The request is classified by the deterministic rules, and the compile response says so in classifierFallback (reason TENANT_LLM_KEY_MISSING).

Where it applies. Only plain-English intake:

• POST /intent/compile and the older /lim/* aliases,
• POST /v1/classify, /v1/classify/batch and /v1/classify/explain,
• webhooks that carry text,
• the simulator.

Where it does not apply. /v1/agent-intent, the SDK's guard() and authorize(), the MCP server, the MCP gateway, the LLM gateway, framework integrations and physical-AI authority requests. These requests are already structured, and they always use the deterministic classifier.

What it needs. Three things, all off by default:

• plain-English intake turned on for your workspace,
• your own OpenAI or Anthropic API key stored for your workspace (encrypted, per workspace),
• the switch turned on by an owner or admin.

Intended sets up plain-English intake and your provider key with you today; there is no self-serve screen for them yet. The console refuses to turn the switch on if no key is on file. If your key is removed later, the switch stays on but requests go to the deterministic rules until a key is back. Intended never uses its own OpenAI or Anthropic key to classify your requests.

Data. The provider receives the request text exactly as written, any hints sent with it (target system, domain, metadata), and instructions that include your workspace's list of allowed actions and any defaults set for it. Intended's built-in redaction (emails, API keys, card numbers and similar) applies to the copy Intended stores, not to the text sent to the model. Don't send secrets in plain-English requests. Intended keeps the model's answer (the proposed action, confidence, rationale and any alternatives) with the compilation record. See Data Handling and Retention.

Choosing a provider. Each workspace uses one provider at a time. Because the call uses your API key, your own agreement with that provider also covers it.

AI policy drafting#

What it does. On the Physical AI policy page, you can describe a rule in a sentence, such as "stop if a person is within 2 metres". An AI model turns it into suggested rules in the rule builder. A person reviews, edits and saves them. Nothing is saved or enforced automatically. If drafting is off or unavailable, the builder works exactly the same without it.

Where it runs. Drafting runs on an open-weight model that Intended hosts itself, inside Intended's own cloud network. It does not call OpenAI, Anthropic or any other third-party AI provider, and Intended's software refuses to send drafting requests to a third-party AI provider's address. Each draft response names the model and version that produced it.

Data. The description you type (up to 2,000 characters) is processed by that self-hosted model. Intended does not store the description or the draft. Only the rules you choose to save are kept. Each workspace has a daily drafting limit.

Block all AI#

Block all AI is a master switch. When it's on, neither feature above calls an AI model, whatever their own switches say. Classification falls back to the deterministic rules and drafting is refused. It also turns off product-improvement contribution (see Product improvement).

You can get the same result for a single request with the header X-Intended-Disable-LLM: 1 (or true). The header is honoured everywhere plain English is accepted: the compile and classify endpoints (/intent/compile, /lim/*, /v1/classify, /v1/classify/batch, /v1/classify/explain), webhooks that carry text, the simulator, and AI drafting.

What never uses AI#

The LLM gateway carries your AI traffic, but doesn't use AI#

If you route your agent's model traffic through the hosted LLM gateway, your requests go to your model provider (for example OpenAI or Anthropic) with your own provider key, as they would without the gateway. That is your traffic and your provider relationship. The gateway does not store your prompts or responses. It reads the tool calls in the model's response and asks Intended for a decision on each one. An allowed call passes through unchanged. A denied or escalated call is replaced with a short message the agent can read. Block all AI does not affect this traffic, because Intended isn't the one calling the model.

What the gateway sends to Intended for each tool call: an action description made of the tool name and the argument names (never their values), the arguments themselves in a separate arguments field, risk flags inferred from the tool name, the model name and request ids. Intended evaluates the argument values in memory and stores them only as a SHA-256 digest. In self-hosted deployments the gateway sends only the tool name and a digest of the arguments. See Data Handling and Retention for how that is stored.

Product improvement#

The deterministic default above is about decisions. Separately, Settings → Privacy & AI has a Help improve the classifier switch. When it is on, Intended may use de-identified structural signals from your workspace, with your workspace, people and agents removed: Open Intent codes, decisions and outcomes, argument names (never values), timing, and tool and target identifiers. They are used to improve classification accuracy and build product intelligence. This work may use machine learning, including training Intended's own models, and runs on models Intended hosts in its own infrastructure.

Prompts are never used for this unless an owner or admin separately turns on Include redacted prompts in product improvement. That setting is off by default on every plan, and it can be turned on only while raw prompt logging is on and Block all AI is off. When it is on, prompts are redacted again before any use (personal data and secrets such as email addresses, phone numbers, URLs, keys and tokens are removed).

Intended does not send your data to any third-party AI provider (such as OpenAI or Anthropic) for this work. Improvements reach the default decision path only as new, versioned deterministic rule sets.

The switch is on by default for Free and Platform workspaces and off for Enterprise. An owner or admin can change it at any time, and Block all AI turns it off too. Anything beyond these signals needs a separate written agreement. The legal terms are in Privacy Policy Section 4B and DPA Section 10.

Every change is audited#

Each change on Settings → Privacy & AI is written to your workspace's hash-chained audit log with who made it, when, and each setting's old and new value. Only owners and admins can change these settings, and only from a console session; API keys cannot.

Sub-processors#

Intended does not send your data to a third-party AI provider on its own account. OpenAI or Anthropic receive data only when you turn on AI-assisted classification, and then only with your own API key for the provider you chose. AI policy drafting never uses them. The LLM Sub-Processor Data Flow page and the Subprocessor List are the legal references.