Security, keys, budget and rights
Keys
- Keys are stored encrypted and cannot be read back once entered, not even by the administrator. Only the last four characters are visible for recognition; a key can only be replaced or revoked.
- One key per provider, with a separate key per environment (trial and production), so a test run never eats the real budget.
- Keys never go to the browser. Every call to an AI provider runs through the server, and a key never appears in a log.
- Every key records who entered it, when, and when it was last used. A key unused for a long time is reported.
Access and roles
Roles are data, not hard-coded e-mail addresses. The Art Director owns the canon and is the only one who finally approves; a Producer may generate and iterate but may not change the canon; a Reviewer may judge and comment but may not finally approve; the administrator manages users, keys, model profiles and budgets and holds no creative verdict. Every action with consequences lands in the audit log with the user, the time and the old and the new value.
Budget
A budget per project and per month, set by the administrator. The estimated cost is shown in the generation screen before anyone clicks generate. At 80 percent a warning follows; at 100 percent new generations are blocked until the administrator raises the limit — reviewing and publishing keep working. On top of that a per-user, per-day limit applies, so a mistake in a series brief cannot burn the monthly budget in one night.
Provenance and rights
For every asset version it is permanently recorded which model and model version, which provider, the complete brief, all reference images, the canon versions, the settings, the user, the moment and the cost. That is needed to answer three questions that will be asked sooner or later: is this image ours, how was it made, and can we reproduce it.
Embargo
An image of a product that still has to be registered as a design may not become public: prior disclosure undermines the novelty requirement. Every asset can therefore carry the embargo flag, with a date and a reason. Material under embargo cannot be published unless someone holding the Art Director role deliberately lifts the embargo with a reason. Tech pack material carries the embargo by default.
Supplier packages
Imagery going to a factory leaves the building. A supplier package is therefore always a separate, temporary link with an expiry date, holds only what that supplier needs, and records who collected what and when. No material is sent around as an e-mail attachment.