BYOK models
Bring your own key. Pick a frontier model per turn from 12 providers. The deterministic brain is the default and mints receipts. The BYOK seam is the only path that routes off it, and only for non-regulated work. Regulated turns stay deterministic no matter what you picked.
Pick a model per turn
A compact pill in the composer controls row shows the current model, or "Deterministic" when none is selected. The pill opens a picker listing the org's active provider credentials. Pick one and the next turn runs on that provider's model, on your key.
The default option is labeled:
Deterministic, Default, receipt-minted
The tooltip when a frontier model is selected:
BYOK frontier model: provider / model. Regulated turns stay deterministic.
You pay your provider directly. The credits meter at the BYOK rate when a frontier model is selected. Clear the chip and the run goes back to the Trinitite-hosted deterministic model.
12 providers
The picker supports 12 providers:
| Provider | Notes |
|---|---|
| OpenAI | Chat Completions and Responses API (the reasoning-model path for o-series and GPT-5). |
| Anthropic | Claude family. |
| Fireworks | GLM and the open-weight frontier. |
| Bedrock | AWS-hosted models. |
| Vertex AI | Google Cloud-hosted models. |
| Cohere | Command family. |
| Together | Open-weight frontier. |
| Groq | Low-latency inference. |
| Mistral | Mistral family. |
| DeepSeek | DeepSeek family. |
| xAI | Grok family. |
| Perplexity | Perplexity models. |
The picker never returns key material. The safe option shape strips the encrypted key, the IV, the tag, the fingerprint, and the key version. Only the last four characters of the key (for UI display) and the non-secret metadata the picker needs (provider, label, allowed models, base URL, last-used) are surfaced. The plaintext key is never decrypted on the picker path.
Deterministic vs frontier
Two paths, recorded on every run:
| Path | When | Receipts | Use |
|---|---|---|---|
| Deterministic | The default. The batch-invariant IInferencePort brain. | Signed, replayable dlir_ receipts per llm_call step. | Regulated work, audit, compliance, anything that needs the receipt chain to hold. |
| BYOK frontier | You picked a provider in the picker, BYOK is enabled, and the turn is not regulated. | The run records inferenceBackend: 'byok_frontier' for audit and replay. | Non-regulated chitchat, lookup, drafting. Faster, looser, no receipt chain. |
The inferenceBackend field on every run result records which path served
the run. Audit and replay read it. A frontier run is honest about being a
frontier run.
Regulated turns stay deterministic
The regulated flag on a request enforces the deterministic path. When
true, the loop must stay on the deterministic IInferencePort regardless
of the BYOK frontier-model config. The BYOK seam never applies to regulated
work.
The server may also force regulated to true based on the tools invoked.
If you ask the agent to touch regulated compliance or audit data, the server
forces the deterministic brain for that turn, even if you left a frontier
model selected in the picker.
This is why leaving a frontier model selected is safe. A regulated turn stays deterministic. The picker is a convenience for the non-regulated chitchat and lookup turns, not a way to bypass the receipt chain on regulated work.
When BYOK is off
The on-and-off switch is the AGENT_BYOK_ENABLED environment variable. When
off, the picker returns enabled: false and an empty credentials list. The
byok field on a run request is ignored. Every run stays deterministic.
The picker is hidden in the composer.
This is the trimmed-posture behavior. A minimal-privilege deploy can leave BYOK off and the chat runs on the deterministic brain only.
Where to go next
- Receipts for the signed receipt chain the deterministic brain mints.
- Chat shell for the composer controls row where the picker lives.
- Named agents for the model override axis on a named agent, which composes with the per-turn picker.