How to Set Tenant-Wide AI Guidelines in DAVE

Summary

The steps

1. 1

   Navigate to Admin Settings

   All tenant-wide configuration lives in a single place. Navigate to Admin, then Settings in the sidebar. The Settings page is visible only to users with the Admin role: every other role sees no Settings option in the sidebar and cannot access this page.

   The Settings page loads your tenant's current configuration in three grouped sections: General (Tenant Name and Application Name), Theme Colors (Primary, Secondary, and Background), and Retention Policy (instance, artifact, and audit log retention durations). These are the top-level general settings. The controls most relevant to AI guidelines are one level deeper, in the System Parameters sub-tab.

   Do this

   • Open the sidebar and click Admin.
   • Click Settings.
   • Confirm the page loads with the General, Theme Colors, and Retention Policy sections visible.
   • Locate the System Parameters sub-tab and click it to access AI and compliance controls.

   Example

   If the Settings option does not appear in your sidebar, your account does not have the Admin role. Ask an existing Admin to assign it to you at Admin, then Settings, then Users and Roles.

   Best practice

   Only assign the Admin role to the people who genuinely need to configure the tenant. Admin is the only role that can change settings, and every change takes effect immediately. Keep the Admin population small and review it quarterly.

2. 2

   Configure the AI Assistant provider and model

   The AI Assistant section is inside the System Parameters sub-tab. It controls which AI provider and model power the platform's AI-assisted features across the entire tenant.

   This setting applies to three specific areas:

   • Prompt Library: AI-assisted prompt generation when building agent prompts.
   • Agent create and edit: AI-suggested descriptions and configurations when creating or editing agents.
   • Any future AI-powered tools outside of workflow execution.

   This setting does not govern workflow agent execution. When a workflow runs and reaches an Agent Interaction node, it uses the provider and model configured on that individual agent, not this setting. The AI Assistant setting is for the platform's own AI helpers, not for the AI your workflows execute.

   Two fields are available:

   • Provider: A dropdown listing all configured AI providers for the tenant (from Admin, then API Management, then Providers). Selecting Auto instructs the platform to try each configured provider in order. Selecting a specific provider pins all AI-assisted features to that provider.
   • Model: A dropdown or text field. Select a model from the provider's catalog, or type a model name manually. Leave blank to use the provider's default model.

   Do this

   • In the System Parameters sub-tab, locate the AI Assistant section.
   • Open the Provider dropdown and select the provider you want to use for AI-assisted features. If you have multiple providers configured and want automatic fallback, select Auto.
   • Open the Model dropdown and select a model, or type a model name. Leave blank for the provider's default.
   • Click Save Settings at the bottom of the form.
   • Confirm the green banner: Settings saved successfully.

   Example

   A content team that has both OpenAI and Anthropic configured as providers might select a specific provider for the AI Assistant setting to ensure consistent prompt suggestions across the team, rather than using Auto, which could produce different suggestions depending on which provider responds first.

   Best practice

   The Provider dropdown only shows providers that have already been configured under Admin, then API Management, then Providers. If the provider you want is not in the list, configure it there first, then return to System Parameters to set it as the AI Assistant provider. Document your choice and the reason in an internal admin log so future Admins understand why a specific provider was selected.

3. 3

   Set compliance audit log standards

   The Audit Log section in System Parameters controls which compliance standards govern the audit trail for the tenant. This is a direct AI governance control: it determines the scope of events captured when users interact with AI-assisted features, run workflows, and access sensitive data.

   Three standards are available:

   • Standard: Always on and cannot be disabled. Captures all mutations, authentication events, and system changes. This is the baseline audit trail that every tenant has by default.
   • SOC 2: Off by default. Adds read-access logging for sensitive endpoints, including users, roles, secrets, and API clients. Covers SOC 2 trust service criteria CC6 (Logical and Physical Access), CC7 (System Operations), and CC8 (Change Management). The SOC 2 standard recommends 7-year audit log retention.
   • GDPR: Off by default. Adds read-access logging for user data endpoints. Covers GDPR Articles 5 (Lawfulness of Processing), 15 (Right of Access), 17 (Right to Erasure), 30 (Records of Processing Activities), and 33 (Breach Notification).

   Each standard is a checkbox. Standard is always checked and greyed out. SOC 2 and GDPR can be independently enabled or disabled. When either is enabled, read-access (GET request) logging is activated for sensitive endpoints: without these standards, only mutating requests are logged.

   When you change compliance standards, a timestamped audit.compliance_changed event is automatically recorded in the audit trail with a before-and-after snapshot of the enabled standards. Every audit event includes a complianceTags array showing which standards the event satisfies.

   Do this

   • In the System Parameters sub-tab, locate the Audit Log section.
   • Review the current state of the SOC 2 and GDPR checkboxes.
   • Check SOC 2 if your organisation operates under SOC 2 requirements or wants comprehensive read-access logging for sensitive endpoints.
   • Check GDPR if your organisation processes personal data of EU residents or wants read-access logging for user data endpoints.
   • Click Save Settings.
   • Confirm the green banner: Settings saved successfully.
   • Navigate to the Audit Log to confirm an audit.compliance_changed event has been recorded.

   Example

   A team that runs AI workflows processing customer data should enable GDPR mode to ensure that every read of user data is logged, not just writes. This creates the processing record required by GDPR Article 30 automatically, without any additional configuration.

   Best practice

   If you enable SOC 2, also review your Retain Audit Logs setting. SOC 2 recommends 7-year retention. The maximum retention option in the dropdown is 730 days (2 years). If your SOC 2 requirements specify longer retention, you will need to export audit logs before they are purged. Set a calendar reminder to export audit logs regularly if your retention requirement exceeds 730 days.

4. 4

   Set retention policy for workflow data

   The Retention Policy section controls how long completed workflow data is kept before automatic cleanup. For a team running AI workflows, this has direct implications for how long AI-generated outputs, review decisions, and audit records remain available.

   Three retention settings are available, each with the same options: 30, 60, 90, 180, 365, or 730 days, or Forever.

   • Retain Instances: How long completed workflow instances are kept. Default is 90 days.
   • Retain Artifacts: How long workflow artifacts (files and outputs generated during execution) are kept. Default is 90 days.
   • Retain Audit Logs: How long audit log entries are kept. Default is 365 days.

   Cleanup runs automatically via a scheduled background task. Expired data is permanently deleted and cannot be recovered. Lowering retention below the current setting may cause existing data to be purged in the next cleanup cycle.

   Do this

   • In the System Parameters sub-tab, locate the Retention Policy section.
   • For Retain Instances, select the duration that matches your operational and compliance requirements. If you need to review AI workflow outputs for quality assurance after completion, set this to at least 180 days.
   • For Retain Artifacts, select a duration. Artifacts include AI-generated content produced during workflow execution.
   • For Retain Audit Logs, select a duration. If SOC 2 is enabled, consider the 7-year recommendation and plan for manual export if your requirement exceeds 730 days.
   • Click Save Settings.
   • Confirm the green banner: Settings saved successfully.

   Example

   A team with a 90-day quality review cycle for AI-generated content should set Retain Instances and Retain Artifacts to at least 180 days, giving reviewers a buffer beyond the review cycle before data is purged.

   Best practice

   Do not reduce retention settings without first exporting or backing up any data you need. Cleanup is automatic and irreversible. Use Forever sparingly: it prevents automatic cleanup entirely, which can increase storage over time. If you are unsure, a longer retention period is always safer than a shorter one.

5. 5

   Configure password and MFA policies

   The Access tab within Settings contains the security controls that govern how users authenticate. For a team running AI workflows, these controls are part of the AI governance picture: they determine who can access the platform and how securely.

   Password complexity options are: None, Basic (8 or more characters), Standard (8 or more characters, mixed case, number), Strong (12 or more characters, mixed case, number, symbol), and Enterprise (16 or more characters, mixed case, number, symbol, no common passwords). The selected level applies to all users on password creation, reset, and change.

   MFA can be enabled with three enforcement options: Tenant-wide optional, Tenant-wide mandatory, or Per-user optional. Eight MFA provider types are supported: Google Authenticator, Microsoft Authenticator, Authy, Duo Security, YubiKey, Email OTP, SMS OTP, and Custom. A grace period of 0 to 30 days can be set to give users time to enroll after MFA becomes mandatory. Trusted device duration (0 to 90 days) controls how long a device remains trusted before re-verification is required.

   Session timeout is configurable from 5 to 1440 minutes, with a default of 60 minutes. Sessions use JWT-based authentication with refresh token rotation: each token refresh invalidates the previous refresh token to prevent replay attacks. Tokens are scoped to the tenant, so there is no cross-tenant token reuse.

   Do this

   • Navigate to the Access tab within Settings.
   • In the Passwords section, select the password complexity level appropriate for your organisation. For teams handling sensitive AI outputs, Strong or Enterprise is recommended.
   • Enable Force Change After Reset (checked by default) to require users to change their password after an admin reset.
   • In the 2FA section, toggle Enable MFA on.
   • Set Enforcement Policy to Tenant-wide mandatory for the strongest security posture, or Per-user optional if you need to phase in MFA gradually.
   • Set a Grace Period to give existing users time to enroll (0 to 30 days).
   • In Session Management, confirm or adjust the Session Timeout. The default of 60 minutes is appropriate for most teams.
   • Click Save Settings after each section.

   Example

   A team enabling MFA for the first time should set a grace period of 14 days, send a communication to all users explaining the change, and then follow up with anyone who has not enrolled before the grace period expires. The Admin can check enrollment status at Admin, then Settings, then Users and Roles.

   Best practice

   Tenant-wide mandatory MFA is the strongest posture for a team running AI workflows with sensitive outputs. If a user loses access to their MFA device, they can use backup codes if that option is enabled. Admins can manually unlock accounts locked by failed login attempts from Admin, then Settings, then Users and Roles.

What tenant AI guidelines actually control

Who should configure these settings and when

The AI Assistant setting versus agent configuration: what each one controls

Frequently asked questions