# Dashboard configuration ownership

The dashboard exposes live edits, deployment drafts and operational observations. Each setting keeps its own source of truth and activation mechanism. Read-only observations, counts, protocol versions and availability are not editable settings.

Use the table to find where a change belongs. The [release scope](../release-status.md) identifies the runtime covered by qualification; a screenshot or local UI check does not qualify a gateway image.

| Family | Authoritative source and scope | Activation / UI treatment | Documentation |
|---|---|---|---|
| Providers | `RegistryProvider`, global registry; dynamic client only for `openai_compatible` | Live typed conditional edit. Adapter immutable. Dynamic endpoint/ref/timeout/quirks/non-secret headers; built-in OpenAI/Anthropic/Ollama client fields disabled and deployment managed. Probe is explicit and potentially billable. | [Provider/model setup](../how-to/add-a-provider-and-a-model.md) |
| Credential pools | `RegistryProviderCredential`, per provider; primary ref on provider | API-only by deliberate v1 scope: existing collection read is unbounded, no exact-member read or edit revision. Use label/ref/enabled/TPM and explicit rotate API; no fake paged pool panel. No secret values stored. | [Second key](../how-to/add-a-second-provider-key.md), [pool contract](../design/adaptive-routing.md) |
| Models and prices | `RegistryModel`, registration identity | Live conditional edits; four USD/1000-token prices, blank undeclared and zero free. Advanced typed capability vocabulary, tier/family, encoding, input/overflow and adapter-specific reasoning effort. Server validates all; declarations are not upstream support evidence. | [Setup](../how-to/add-a-provider-and-a-model.md), [admin API](admin-api.md) |
| Model lifecycle, aliases, fallback | Registry lifecycle and successor validation | Existing monotonic state machine; deprecation timestamp preserved, not independently authored. Bounded suggestions and complete server validation. Legacy YAML is seed-only once database registry owns the snapshot; no competing YAML editor. | [Routing](../routing-strategies.md) |
| Routing groups | `RoutingProperties`, gateway deployment | Complete ordered local draft with strategy/objective/weights/conditions/affinity; bounded member lookup, whole-draft validation. Export is not activation; merge, restart and verify. | [Split traffic](../how-to/split-traffic-between-models.md) |
| Resolution, tiers, fallback, provider ceilings | `RoutingProperties`, `RequestAdmission`, `FallbackLadder`, `ModelResolver` | Effective readouts; reviewed Studio subset only. Other structured settings remain documented deployment configuration. Missing/unknown/denied and tier directions remain distinct. | [Configure](../how-to/configure-pointsman.md), [controls](../gateway-controls.md) |
| Organization defaults / key resolution | Identity policies, scoped DB rows | Existing live scoped editors preserve complete replacement fields, inherited and empty-allowlist semantics. Authorized catalog exact lookups independent of pages. | [Auth/tenancy](../design/authentication.md) |
| Adaptive balanced/cost/direct learning | Group objective, gateway sampler snapshots, deployment flags | Preserve objective/provenance/read-only learning views. The matching qualified gateway/dashboard exposes provider/model cost-arm identity and objective; these views do not establish real-model quality or savings. | [Outcome learning](../how-to/turn-on-outcome-learning.md) |
| Quality profiles/evaluation/latency | Quality policy/evidence stores, expected versions | Existing complete promotion/rollback reviews; metadata histories and explicit evidence detail. Advanced evaluation ingestion remains supported API/tool workflow, not a new wizard. Classification confidence is not output quality. | [Quality routing](../how-to/quality-guarded-routing.md) |
| Jev classifier | Actual `JevProperties` holder when enabled; validated configured bean when disabled | Separate starter and deployed draft. Sanitized baseline/version, explicit consent/tenant UUIDs, ordered canonical model-ID rankings, bounded exact references, changed-key exports. Secret-manager binding preserved; probability tolerance read-only. No classifier calls from reads/review/export/artifact inspection. | [Jev](../how-to/jev-routing.md) |
| Budget/rate/concurrency | `RateLimitProperties`, limit rules, identity limits, `RequestAdmission` | Existing live scoped rules/limits and inherited caps; global reviewed deployment drafts. Failure mode, fence and store-check posture read-only. No fail-open/reset controls. | [Keys/budgets](../how-to/issue-keys-and-set-budgets.md), [controls](../gateway-controls.md) |
| Identities/allow policies/grants | Core scopes/grants/policies and identity DB | Scoped live authorized writes; bounded pages/exact references, full allowlist validation, enforcement flag remains deployment owned. | [Hierarchy](../how-to/build-a-team-hierarchy.md) |
| Guardrails | Descriptors, DB settings and restrict-only resolver | Existing descriptor-driven live controls/dry-run and inheritance. Boot regex/schema/external moderator wiring stays deployment/API managed; dry-run is not provider readiness evidence. | [Guardrails](../how-to/write-and-enforce-a-guardrail.md) |
| Cache | `CacheProperties`, live thresholds/context/temperature policy, verifier | Existing cache readouts and reviewed numeric/boolean Studio drafts. Operational readouts include effective byte ceilings and cached L2 guard. Context relaxation, generation contract and verifier are read-only/deployment managed; no index recreation. | [Cache tuning](../how-to/tune-the-semantic-cache.md), [semantics](../semantic-cache.md) |
| Tokenization/embedder | `TokenEstimator`/admission, `ContentEmbedder` pipeline | Read-only actual capacities/wait, identity/readiness/token window; no model download. Embedder/index dimension change requires migration planning. | [Operational limits](operational-limits.md) |
| Streaming/retry/cancellation/outbound pools | `ModelRouter`, `StreamIdleTimeout`, controller and adapter clients | Actual first-event/idle/total ms readouts, deployment managed; no retry-all action. Outbound pools remain deployment configuration. | [Operational limits](operational-limits.md) |
| Journal/recovery/restore | `UsageJournal`, epoch stores, budget trust/evidence | Read-only configured admission/Q and explicit protected existing recovery workflows. Q means waiting admission capacity. Volume durability/topology and full report/manifest runtime computation remain deployment/runtime owned. No real recovery executed in local checks. | [Journal epochs](../operations/journal-epochs.md), [readiness](../release-status.md) |
| Retention | Tenant DB retention and global deployment windows | Existing scoped retention edit/reset; deletion consequences explained. Global ledger/evaluation/recovery windows/purge scheduling deployment owned. | [Operating notes](../operating-notes.md) |
| Telemetry/alerts/audit/content capture | Tracer/capped capture holders, observation/collector configuration | Read-only availability/content posture; delivery unknown without evidence. Collector/alert destinations, Spring AI logging and privacy decisions deployment owned. Charts do not prove alerts configured. | [Operating notes](../operating-notes.md), [security](../security.md) |
| Security/infrastructure | Auth pepper/bootstrap, egress, Redis/DB, TLS/CORS, JVM/cgroups/volumes | Deployment-only. Safe readiness facts exclude secrets, addresses and environment dumps. No browser actuator writes, topology editors or convenient recovery bypass. | [Deploy](../how-to/deploy.md), [security](../security.md), [multi-instance](../design/README.md) |
| Learner configuration | Python Settings/environment and authenticated gateway-held snapshot | Deployment-only tuning; gateway reports cached provenance/age/degraded state without querying the learner. No authenticated sanitized learner-settings source exists. | [Learning](../how-to/turn-on-outcome-learning.md) |
| Studio/Canvas/Rehearse/Delivery | Reviewed UI metadata plus existing effective APIs | Studio drafts, feature pages edit supported live fields, Canvas explains, Delivery reviews complete local changes. Draft/saved/applied/observed/verified are separate. No generic settings writer. | [Dashboard tutorial](../tutorial/dashboard.md) |
| MCP | No shipped management backend | Deliberately excluded: future scoped server/tool/schema discovery, inherited access, bounded status refresh and reviewed writes require a real backend. | Dashboard audit |

Every row is a family-level coverage decision, not a claim to expose every nested property. The source inventory below also covers boot-bound types that the environment-file reference cannot enumerate. Direct `Environment` policies (context, temperature, thresholds), registry/core/quality DB settings and Python/deployment configuration are covered by the families above. A declaration does not imply live mutability. Exact keys/defaults/constraints remain on the authoritative types and runbooks.

## Conditional registry edits

### Edit and resolve conflicts

Use this workflow for `PATCH /admin/registry/models/{id}` and `/admin/registry/providers/{id}`:

1. Read the row and retain its opaque `expected_revision`.
2. Send typed changes with that revision. Omitted fields preserve their value; explicit null clears nullable fields. Identity, enabled and lifecycle fields cannot be cleared; unknown fields are refused.
3. For a toggle, send only `enabled` and the revision.
4. On `409`, review the current row and explicitly save again. The UI retains the draft and does not automatically merge or retry.

Optimistic comparison, validation, registry version and audit commit in the same transaction; publication follows commit. A conflict rolls the write back. Existing POST/PUT/import replacement semantics remain available.

> **Upgrade boundary:** every registry writer must use version-aware code, or writes must be frozen before conditional editing. JPA `@Version` covers PUT, import and probe; an older binary cannot advance the V66 `edit_version` column.

Per-row provider reads return stored non-secret headers; import/export/review redacts values with the existing digest marker and refuses that marker as input. Do not import a redacted export as a complete editable row. New API-only credential-pool scope is not a claim that one primary ref represents the entire pool.

## Deployment drafts and observations

These root-ADMIN endpoints distinguish configuration review from live actions.

| Endpoint | Returns or validates | Does not do |
|---|---|---|
| `GET /admin/control/jev-configuration` | Sanitized settings, credential presence, receipt and disabled/effective/unready state | Create a classifier client |
| `POST /admin/control/jev-configuration/review` | Receipt, complete proposed settings, tenant UUIDs and model rankings | Write configuration or classify content |
| `GET /admin/control/operational-readiness` | Runtime holders and cached observations for this instance | Refresh stores, probe health, recover state or call a provider |

### Apply a reviewed Jev export

1. Merge the exported changed keys and preserve omitted settings and the existing secret binding.
2. If `task-models` changes, replace the complete ordered map and remove deleted tasks. A shallow merge can retain obsolete tasks.
3. Check environment overrides, validate, restart and fetch readback.

`max-calls-per-process` resets with the process. It is neither a durable dollar budget nor a fleet-wide quota.

### Interpret readiness observations

- Distinct Redis endpoint settings do not prove physical separation.
- Cached age `-1` means never observed. Missing holders remain unavailable; stale data does not imply health.
- Volume durability and collector delivery need their operating procedures and evidence.
- Readouts describe one instance, not cluster state or acceptance of the qualified profile.

## Guided configuration lifecycle

Get started offers first-request, shared-budget and adaptive-decision recipes within
the existing console. Its dismissible journey links existing actions and never sends
traffic automatically. Only account/origin-scoped recipe and dismissal preferences
persist. Correlation is memory-only; organization selection clears on account change
or reload. No credentials, prompts, outputs or tenant selections are saved by the guide.

The dashboard keeps these configuration stages separate.

| Stage | What it establishes | What remains |
|---|---|---|
| Local draft | A proposed change | Save or export review |
| Saved configuration | Storage accepted a change | Activation, where required |
| Deployment required | Restart or deployment work is pending | Apply and read back |
| Observed effective value | A runtime value was read | Verify the intended behavior |
| Behavior verified | A relevant check observed the outcome | Stay within that check's scope and conditions |

An enabled row, successful save or recent timestamp does not prove all stages completed. When an API supplies only a value, explicit/default/inherited provenance remains unknown.

### Global limits and activation

The four `pointsman.ratelimit.global-*` ceilings are gateway-wide, shared across
organizations; organization/application/user/key limits are additional constraints.
The three RPM/TPM/spend values come from the immutable `PlatformCeilingRules` snapshot
that the engine appends, with `source: runtime-holder` and `mutability: boot`.
They show **Loaded platform rules** and **Restart required**, not Operator refresh.
Later property rebinding cannot change those readouts or rebuild those rules.
Current configured targets are not separately projected for these three entries;
inspect deployment configuration before a restart. This readout is loaded policy,
not proof of observed enforcement, available counters or production health.

The active rule amount is reported in the existing wire units: requests, tokens
and exact micro-dollars (USD multiplied by 1,000,000). An absent rule is null,
including when null, zero or a negative value at construction synthesized no rule;
a later positive property target cannot create one. Loaded windows are described
from the rules themselves: RPM/TPM roll over one minute, spending uses a calendar
day anchored at 00:00 UTC. Separately labelled configured counter-window properties
are not those loaded windows.

Concurrency is deliberately separate: its existing mutable property value and
refreshable metadata remain, and admission reads that holder on each call. Only a
positive concurrency value adds the global scope; null/non-positive adds none.
The UI does not reinterpret zero for unrelated controls.

### Policy path versus enforcement

The tree's `enforced_on_request_path` describes policy path mode, not every rule or
grant. With it off, mirrored fixed-chain rules still apply, and deeper-only rules do
not automatically join that path. With it on, stored-path mode is reported, with
runtime fallback where applicable. Missing/loading/stale/error mode evidence is
unverified. Scope binding previews are not per-request enforcement certificates;
management permissions remain separate.

### Request correlation

Requests use the numeric ledger ID for exact authorized detail. `X-Request-ID` is log
correlation; `X-Pointsman-Request-ID` is the gateway UUID stored as `request_id`.
There is no exact UUID lookup in this console API. The journey provides copyable
correlation and manual ID verification, never a newest-row guess or automatic polling.
Missing records can be delayed or hidden; recorded 2xx is status evidence only.
Missing usage/cost stays unknown. Stream completion, settlement and quality have
separate evidence requirements.

See the [dashboard recipes](../tutorial/dashboard.md#choose-a-setup-recipe) and
[fixed-chain boundary](../design/authentication.md). Existing deployment-only
secrets/infrastructure, API-only credential pools and absent MCP management remain
intentional boundaries; this guidance adds no runtime controls.

## Bound source inventory

<!-- bound-sources:begin -->
| Bound prefix | Authoritative declaration | Treatment |
|---|---|---|
| `pointsman.auth` | `gateway/src/main/java/dev/pointsman/gateway/tenancy/AuthProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.bandit.composition` | `gateway/src/main/java/dev/pointsman/gateway/routing/bandit/RewardCompositionProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.bandit.exploration` | `gateway/src/main/java/dev/pointsman/gateway/routing/bandit/ExplorationProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.bandit.reward` | `gateway/src/main/java/dev/pointsman/gateway/routing/bandit/RewardProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.cache` | `gateway/src/main/java/dev/pointsman/gateway/cache/CacheProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.catalog` | `gateway/src/main/java/dev/pointsman/gateway/config/CatalogProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.add-prefix` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/MutatorRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.azure-content-safety` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/AzureContentSafetyGuardrail.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.blocked-pattern` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/BlockedPatternProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.case-check` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/CaseCheckRule.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.char-count` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/CountRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.contains-code` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/OutputCheckRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.contains` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/ContainsProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.ends-with` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/EndsWithRule.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.json-keys` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/OutputCheckRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.json-schema` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/JsonSchemaRule.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.log` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/LogGuardrail.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.mistral-moderation` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/MistralModerationGuardrail.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.not-null` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/OutputCheckRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.openai-moderation` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/OpenAiModerationGuardrail.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.pii` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/PiiProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.regex-replace` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/MutatorRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.response-blocked-pattern` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/ResponseBlockedPatternProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.response-pii` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/ResponsePiiProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.sentence-count` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/CountRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.valid-urls` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/ValidUrlsRule.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.webhook` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/WebhookGuardrail.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.guardrails.rules.word-count` | `gateway/src/main/java/dev/pointsman/gateway/guardrail/rules/CountRules.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.jev` | `gateway/src/main/java/dev/pointsman/gateway/routing/jev/JevProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.models` | `gateway/src/main/java/dev/pointsman/gateway/config/ModelAliasProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.pricing` | `gateway/src/main/java/dev/pointsman/gateway/tenancy/PricingProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.providers` | `gateway/src/main/java/dev/pointsman/gateway/config/ProviderProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.quality` | `gateway/src/main/java/dev/pointsman/gateway/quality/QualityProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.ratelimit` | `gateway/src/main/java/dev/pointsman/gateway/ratelimit/RateLimitProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.redis` | `gateway/src/main/java/dev/pointsman/gateway/redis/RedisProperties.java` | Deployment/API ownership above; no inferred editor |
| `pointsman.routing` | `gateway/src/main/java/dev/pointsman/gateway/config/RoutingProperties.java` | Deployment/API ownership above; no inferred editor |

<!-- bound-sources:end -->