AI governance & data use
Physics decides the numbers; the assistant explains them and proposes the next move. This page states what each AI surface is allowed to do, who has to approve it, and where the trace lives — 9 surfaces, 7 commitments, all read from the same registry the code uses at runtime.
Commitments
Your data is not used to train models
Prompts and context are sent to the model provider only to answer the request in front of you. We do not fine-tune, train, or otherwise build models on customer operational data.
Every gateway call is made from a server function with a per-request context payload.
A human approves anything that changes a run
No AI surface can start a run, edit a saved case, or alter a validated solver specification on its own. Surfaces are classified as advisory, navigation-only, or explicit-apply — and the classification is in code, not in a policy document.
See the per-surface model cards below; each declares its approval mode.
The solver, not the model, decides the numbers
AI proposes and explains; the deterministic kernel computes. Every candidate design an assistant suggests is scored by the same solver a manual case uses, so a model cannot make a design look better than the physics says it is.
Solver spec scoreboard and validation gallery.
Context is bounded and redacted
Copilot context is capped at a fixed byte budget and stripped of secrets before any call. Server functions never log raw input payloads, and activity logs record event kinds and subjects rather than free-form fields.
Context packagers enforce the budget in unit-tested pure libraries.
Drift is monitored, not assumed away
Solver outputs are pinned by snapshot drift guards and nightly canary sweeps; calibration watch flags a match that has moved away from measured data. Model changes cannot quietly move a published result.
Drift-guard configuration and calibration watch surfaces.
Every AI-assisted decision leaves a trace
Fleet decision memos, the audit trail, and governance reports record which surface ran, on which batch, and what the operator accepted. Reports are exportable for internal review.
Fleet audit trail and governance report export.
You can see and change the model
Each surface has a default tier and a documented fallback. Model preferences are user-visible and overridable, so an operator with a model policy can pin the surfaces to models they have approved.
AI model preferences card in settings.
Model cards, per surface
Every surface declares a default model tier, a documented fallback for rate limits, and an approval mode. Approval split today: 5 advisory, 3 explicit-apply, 1 navigation-only. Model choice is overridable in settings if your organization pins an approved model list.
Engineer Copilot
Answers engineering questions against the manual, the solver spec, and the current run context, with citations back to the source section.
- Hard limits
- Cannot write solver kernel code or bypass a validated solver spec.
- Cannot change a saved case, schedule, or run without an explicit user action.
- Context is capped and redacted before the call.
- Traceability
- Workspace activity log records the event kind and subject, not the raw payload.
- Rate-limit fallback
- google/gemini-3.1-pro-preview
Setup Assistant
Turns a plain-language well description into a draft input set for the wizard so a case can be started without hand-typing every field.
- Hard limits
- Produces a draft only — every field remains editable and is re-validated by the wizard.
- Cannot change a saved case, schedule, or run without an explicit user action.
- Traceability
- Draft is persisted as a wizard draft with its origin recorded.
- Rate-limit fallback
- google/gemini-2.5-flash
Design Copilot
Proposes candidate frac designs and ranks them on a physics-checked Pareto frontier, with rationale per candidate.
- Hard limits
- Every candidate is scored by the deterministic solver, not by the model.
- Cannot submit a run on its own.
- Cannot write solver kernel code or bypass a validated solver spec.
- Traceability
- Accepted candidates carry the proposal id into the run record.
- Rate-limit fallback
- google/gemini-3.1-pro-preview
Diagnostic Studies attribution
Attributes a diagnostic-study result to candidate physical drivers and drafts the study write-up.
- Hard limits
- Attribution text never replaces the numeric sensitivity output it describes.
- Cannot write solver kernel code or bypass a validated solver spec.
- Traceability
- Study record stores the model id and the input digest.
- Rate-limit fallback
- google/gemini-3.1-pro-preview
Forecast Narrative
Writes the narrative summary that accompanies an auto-forecast or history match.
- Hard limits
- Narrative only — cannot alter forecast numbers or match parameters.
- Cannot change a saved case, schedule, or run without an explicit user action.
- Traceability
- Narrative is stored alongside the forecast it describes.
- Rate-limit fallback
- google/gemini-2.5-flash
Driller's Copilot
Answers rig-side questions (stuck pipe, kick/loss, MSE, swab/surge) and drafts the morning report.
- Hard limits
- Advisory only — never an instruction to the rig, and never a substitute for the well-control program.
- Cannot change a saved case, schedule, or run without an explicit user action.
- Traceability
- Question and answer are kept in the session buffer for the shift report.
- Rate-limit fallback
- google/gemini-2.5-flash
Command Palette ✨ picks
Ranks command-palette results for a typed intent so the right route opens faster.
- Hard limits
- Only ranks existing commands — cannot invent an action or mutate data.
- Traceability
- No payload is retained beyond the keystroke session.
- Rate-limit fallback
- google/gemini-2.5-flash-lite
AI Author
Drafts documentation, release notes, and report prose from shipped-feature records.
- Hard limits
- Drafts are reviewed before publication.
- Cannot claim a capability that is not in the shipped-feature registry.
- Traceability
- Drafts are versioned with the source registry entries they cite.
- Rate-limit fallback
- google/gemini-2.5-flash
Live-Pumping Operator Copilot
Narrates the live pumping stream and drafts a diagnostic study from what it observes.
- Hard limits
- Advisory only — never actuates a pump, valve, or setpoint.
- Context is condensed to a fixed byte budget before the call.
- Cannot change a saved case, schedule, or run without an explicit user action.
- Traceability
- Last intent and drafted study are surfaced in the panel and copyable for the job file.
- Rate-limit fallback
- google/gemini-2.5-flash