Why Sculptor offers Organisation, Personal, and Conversation LLM settings

Sculptor does not force a single global AI backend. In an organisation cloud workspace, the chat composer exposes three scopes—Organisation, Personal, and Conversation—plus Settings and Company account screens behind them. That is intentional: strategy work mixes sensitive drafts, team-wide defaults, and phase-specific model needs in one product.

The three layers in plain language

Organisation (Company account)

Admins configure Organisation default LLM under Company account → Organisation AI:

• Default provider and model id for members who choose Prefer organisation defaults when available in Settings.
• Optional shared API keys per provider (stored encrypted on the server; the UI never re-displays saved secrets).
• Team HTTP MCP servers and related org-wide AI integration (separate from LLM keys but configured on the same tab family).

When a member’s workspace preference is company preferred and a request qualifies, the server merges the organisation key for that provider into the proxy call—without uploading the member’s personal key to the company vault.

Personal (Settings on your device)

Settings is where each member keeps:

• Active provider tabs (Ollama local/cloud, OpenRouter, OpenAI, Anthropic, Gemini, …).
• API keys encoded in this browser (bring-your-own-key).
• Prefer organisation defaults vs Use my keys on this device (llmCredentialMode).

Personal keys are not uploaded to the organisation as a shared credential vault. Company copy states explicitly: shared LLM access is via organisation defaults + org-stored keys, not by harvesting everyone’s Settings keys.

Conversation (this thread only)

Open Conversation from the composer (or the conversation LLM dialog) to set:

• Provider and model id for this conversation only.
• Whether this thread uses Organisation default or My Settings credentials (llmKeysPreset), when org defaults exist.

New conversations still start from Settings (and org defaults when preferred). Changing one thread does not rewrite your global default—useful when only one phase needs a stronger or cheaper model.

Why privacy needs three levels

You choose who sees prompts

Every LLM call sends workspace context (messages, library excerpts, strategy prompts) to whichever provider you selected. That provider’s privacy policy applies. Sculptor’s privacy policy and DPA treat third-party LLMs as controller-directed: they are used when you or your organisation enable them, not silently for all tenants.

Three layers let you align data boundary with credential boundary:

Need	Control
Company-approved vendor only	Org default + org keys + member preference Prefer organisation defaults
Founder BYOK / side project	Personal keys; org merge skipped
Sensitive thread on a shared laptop	Conversation → personal keys even if workspace usually prefers company
Legal review on OpenAI, daily chat on Ollama Cloud	Conversation provider/model per thread

Personal keys stay on the device

Settings keys live in local browser storage (encoded), not in the org Postgres row. Switching Prefer organisation defaults does not delete your saved personal keys—you can return to Use my keys on this device anytime.

Organisation keys stay on the server, applied only when allowed

Org keys are decrypted server-side only when the derived preset is organisation, the member’s DB preference is company_preferred, and a matching encrypted blob exists. A thread saved with llmKeysPreset: personal sets skipOrgKeyMerge on agent routes—your device keys only for that call, even if the UI had been on Organisation moments earlier.

Explicit overrides beat silent sharing

The Conversation pill exists so privacy and billing choices are visible per thread, not inferred. Saving “use organisation keys” on a conversation while your global mode is still personal is possible in the dialog—but server merge rules still respect membership prefs; the product docs in docs/developemnt/ORG-LLM-CHAT-CREDENTIALS.md describe the full matrix for operators.

Why split cost across multiple AI providers

No single model wins every strategy task. Intake may be fine on a fast cheap model; coherence validation may need a larger context window; prototype phases might target a code-friendly endpoint.

Strategy	How Sculptor supports it
Central org wallet	One OpenRouter or Anthropic org key; members use Organisation preset when provider+model match defaults
Personal experiments	Your OpenAI key on Personal without touching team quota
Per-phase model	Conversation override: e.g. llama3.x for brainstorm thread, flagship model for /validate thread
Local inference cost	Ollama (local) on Personal—no per-token cloud bill (your hardware)
Multi-vendor routing	OpenRouter as one API surface to many models; switch model id per conversation

Spreading work across providers is a finance and reliability tactic: rate limits on vendor A do not block vendor B if another thread uses a different conversation snapshot.

Shared and “free” API access (what we actually offer)

Sculptor does not ship unlimited universal API keys to every user. What teams can offer:

Organisation-hosted keys (shared access)

An admin pastes a provider key under Company account. Members who prefer organisation credentials use that key when the request preset is organisation and provider/model align with org defaults (or the conversation explicitly requests organisation keys). The company pays the vendor; individuals are not forced to create personal accounts for baseline coaching.

That is the main sense of “free to the member”: no personal card required when the org key is configured and merge rules apply.

Discovering free models on Ollama Cloud

For Ollama (cloud) org defaults, admins can run Find free models (probes models against Ollama’s API). Results help pick a default model id that sits on a free or lower-cost tier on the org’s Ollama account—cached in the browser so the probe is not repeated every visit. This is discovery, not Sculptor subsidising tokens.

Personal free tiers and BYOK

Members can still attach their own keys to free tiers (OpenRouter credits, Gemini free tier where available, local Ollama, etc.) under Personal Settings—useful when the org has no key yet or you are outside org policy.

Always check your provider’s current pricing; Sculptor only routes requests to the endpoint you configured.

Choosing the best model per conversation

Settings answers: “What should new chats use?”
Conversation answers: “What should this chat use?”

Stored per conversation:

• providerSnapshot — which backend.
• modelId — which model string (if empty, falls back to the default model for that provider in Settings).
• Optional llmKeysPreset — organisation or personal from the dialog.

Credential preset logic (simplified)

When you do not set an explicit thread preset:

1. If you are not on Prefer organisation defaults → personal keys.
2. If org defaults are missing or invalid → personal keys.
3. If thread provider + model match org defaults → organisation keys.
4. If thread uses a different model (or provider) than org default → personal keys for that request—even if you still “prefer” org mode globally.

So changing only the model on a thread automatically switches billing to your keys unless you also pin organisation keys in the conversation dialog. That prevents accidentally burning the org key on an expensive one-off model.

Practical patterns

Scenario	Setup
Daily coaching on org stack	Org defaults + member Prefer organisation + new chats unchanged
One deep dive on GPT-4 class model	Conversation → change model; accept personal key or set explicit org preset if admin allows
Consultant on client org	Personal keys + personal provider; client data policy via your vendor choice
Agentic pack on org default	Same org provider/model as chat when phases use workspace LLM config

Agentic runs reuse the same Settings + org defaults + credential mode stack as chat unless a future server executor adds separate overrides—see Fundamental AI terminology.

How the composer pills map to actions

In org cloud workspaces, three pills appear (labels may be localized):

Pill	Click behaviour (summary)
Organisation	Prefer company_preferred; clear per-thread key override when switching workspace-wide
Personal	Prefer personal device keys; clear per-thread key override
Conversation	Open dialog: provider, model, org vs personal keys for this thread

Conversation is highlighted when the thread has an explicit saved llmKeysPreset. Organisation / Personal reflect your member-level preference when no thread override is active.

For operators, the full decision flowchart lives in docs/developemnt/ORG-LLM-CHAT-CREDENTIALS.md in the repo.

What this does not solve by itself

• Token budgets per user — org keys are shared; use provider dashboards or separate org accounts for hard caps.
• Automatic model routing — Sculptor does not auto-pick “best” model; you or your admin choose provider/model per layer.
• Cross-device key sync — personal keys remain per browser; repeat Settings on each device.
• Hiding prompts from Sculptor — the app must assemble prompts on the server for cloud workspaces; provider choice controls downstream sharing, not whether Sculptor processes the thread.

Related reading

• How to set up Ollama Cloud in Sculptor — personal provider setup and per-conversation model.
• Fundamental AI terminology in Sculptor — provider vs model vs prompt.
• Connect MCP servers to Sculptor — org vs personal MCP toggles alongside LLM credentials.
• Coach persona and answer style — per-project voice separate from provider choice.

Organisation, Personal, and Conversation settings exist so teams can standardize what they use, individuals can control whose keys pay for it, and each strategy thread can pick which model fits—without merging every concern into one brittle global toggle.