{"training":{"id":"T-PROVIDERS-1","slug":"approved-model-providers","title":"Approved model providers","policyId":"P-PROVIDERS","minutes":3,"version":1,"lang":"en","assignment":{"happened":"On {date}, {agent} on {device} made a request to {provider}, a provider that is not on the approved list; {blocked}.","matters":"A {minutesWord} training shows why the list of approved providers matters and what to use instead."},"lesson":[{"id":"what-happened","heading":"What happened on {device}","body":["On {date} at {time}, {agent} on {device} made a request to {provider} during a session: {session}. qcontrol recorded it as: {evidence}.","{provider} is not on the approved list, so the policy {policy} recorded a finding. {outcome}"],"illustration":{"scene":"provider-request","alt":"{agent} on {device} sends a prompt to {provider}, which is not on the approved list.","animated":true}},{"id":"where-prompts-go","heading":"Where a prompt goes","body":["A prompt carries everything your agent puts in it: the files it read, the text you pasted, a customer's details in a ticket. Each request sends all of it to the provider.","The provider's terms decide what happens next: where prompts are stored, for how long, and whether they are used for training. The approved providers work under terms your organisation agreed to. A provider off the list works under terms nobody here has read."],"illustration":{"scene":"provider-terms","alt":"The approved providers work under terms your organisation agreed to; a provider off the list works under terms nobody here has read."}},{"id":"what-qpoint-does","heading":"What Qpoint does about it","body":["qcontrol checks where each request from your agent goes against the approved list: {approved}. A request anywhere else is a finding.","Under Observe the request goes through and the finding records it. Under Enforce it is blocked before it leaves {device}."],"illustration":{"scene":"policy-modes","alt":"The same request under each mode: Off lets it through, Observe lets it through and records it, Enforce stops it and records it."}},{"id":"instead","heading":"What to do instead","body":["Use the approved providers for work: {approved}. Check which provider and model your agent is set to use, including a helper that a colleague or a setup guide added.","When your work needs a provider that is not on the list, ask {owner} to review it before you send it anything.","If a provider you do not know asks for more, such as card details, a password or a customer's records, send nothing and tell {owner}."],"illustration":{"scene":"mode-ask","alt":"You ask IT or the policy's owner about the provider your work needs; it is approved, or {team} gets an exception."},"instead":true}],"check":[{"id":"q-what-goes","prompt":"Your agent sends a prompt to a provider that is not on the approved list. What goes with it?","choices":[{"id":"a","text":"Only the question you typed"},{"id":"b","text":"Everything in the prompt, including the files and text the agent added","right":true},{"id":"c","text":"Nothing, until you save the answer"}],"explain":"Each request carries everything in the prompt: the files your agent read, the text you pasted and any customer details in it.","stepId":"where-prompts-go"},{"id":"q-terms","prompt":"Why does it matter which provider a prompt reaches?","choices":[{"id":"a","text":"Some providers answer more slowly"},{"id":"b","text":"Only the price differs between providers"},{"id":"c","text":"Its terms decide where the prompt is kept and whether it is used for training","right":true}],"explain":"The provider's terms decide where prompts are stored, for how long, and whether they are used for training. The approved providers work under terms your organisation agreed to.","stepId":"where-prompts-go"},{"id":"q-new","prompt":"A colleague shares a cheaper model that works well for your task. What do you do?","choices":[{"id":"a","text":"Ask {owner} to review it before you send it any work","right":true},{"id":"b","text":"Use it for work that is not confidential"},{"id":"c","text":"Try it for a week, then ask"}],"explain":"A provider off the list works under terms nobody here has read. Ask {owner} to review it before you send it any work.","stepId":"instead"},{"id":"q-asks","prompt":"A model your agent uses asks for a card's expiry date and security code \"to verify a refund\". What do you do?","choices":[{"id":"a","text":"Send them; the agent is helping with the refund"},{"id":"b","text":"Send the expiry date only"},{"id":"c","text":"Send nothing, and tell {owner} which provider asked","right":true}],"explain":"A refund never needs those. Send nothing, and tell {owner} which provider asked.","stepId":"instead"}],"contact":{"owner":"{owner}","how":"Contact IT from the message that brought you here, or reply to it; the replies reach {owner}."},"library":{"lesson":[{"id":"what-happened","heading":"What happens when an agent uses a provider off the list","body":["Your agent on {device} sends each prompt to a model provider. qcontrol sees where each request goes and checks it against the approved list.","When a request goes to a provider that is not on the list, the policy {policy} records a finding."],"illustration":{"scene":"provider-request","alt":"{agent} on {device} sends a prompt to a provider that is not on the approved list.","animated":true}}],"check":[]}},"version":1,"contentHash":"sha256:39ef31c9c92add262aa3f4087b372035d9dc83f46fd9df12a8ab431eedffe634","slots":["agent","approved","blocked","date","device","evidence","minutesWord","outcome","owner","policy","provider","session","team","time"],"path":"app/data/trainings/en/approved-model-providers.md"}