GL alpha

Governance layer test harness — chat, per-user cost logging, usage report.

Prevent catastrophic cost runaways
Monitor AI spend per user and AI spend per project
Trammel non-work related web browsing
Restrict sensitive files uploaded to AI
Lock Google Drive access to permitted AI directories
Mask PII and financial info, secret keys etc

Acting as (test only — replaced by real login later) Project

Prompt

📎 Attach file (PDF, Word, Excel) ✕

⚠ This reply was cut off (hit the response length limit) — ask Claude to continue, or to shorten the output.

Usage report

Loading budget position…

User	Project	Requests	Tokens	Searches	Search (£)	Files	Spend (£)
Loading…

Spend by project

Project	Requests	Tokens	Spend (£)
Loading…

Web access

Loading…

Configured per site in sites/<id>.json under webTools, then pushed with scripts/sync-site-config.mjs. An empty domain list means unrestricted; add domains to restrict.

Upload restrictions

Loading…

Configured per site under allowedFileTypes, maxFileSizeMb, and blockedFilenamePatterns (* wildcard, matched against the filename only — browsers don't expose a local file path to block).

Cloud drive access

Loading…

Google Drive access, where connected, is read-only and scoped to one shared folder (including its subfolders) — enforced by the folder's own sharing permissions, not something a user in chat can widen. OneDrive is scaffolded under cloudDrives in each site's config but has no connector built yet.

Sensitive data masking

Loading…

Applied to every message before it reaches Claude — matched patterns are checksum-validated (Luhn for cards, mod-97 for IBANs, Modulus 11 for NHS numbers) to keep false positives low. Does not yet cover text inside uploaded files, or the conversation history stored in your own browser.