Smartplane helps organisations govern what their AI agents do. To check plain-language rules such as “nobody deletes reports from the Q3 folder”, it uses AI models of its own. This page sets out every place that happens, what data is involved, and what you can rely on. It supplements our Privacy Policy.
The short version
- All of Smartplane’s AI processing runs on Cloudflare Workers AI, inside the same provider that hosts Smartplane. We do not send your data to any other AI provider.
- Cloudflare’s Workers AI data usage terms say Cloudflare does not use the content it processes to train AI models and does not keep inputs or outputs after answering a request. We do not train models on your data either.
- Models never receive secret values or tokens. Anything in a call’s arguments that looks like a credential is replaced with
[redacted]before a model sees it. - The model that helps write rules never receives your member directory. The call-time check receives a person’s email address only when a rule judging that call names people.
- Rule checks are probabilistic. They help you catch actions you did not intend; they are not a guarantee. Access grants, which are checked in code before any model runs, remain the primary control.
Where AI is used
1. Checking each tool call against your rules
When an agent calls a tool, Smartplane first checks the caller’s access grants in code. If the call is allowed, it works out which of your organisation’s active guard rules apply to it, again in code, from each rule’s scope and its accepted call filter. Only the rules left need a judgement. If none are left, no model is called. Otherwise Smartplane makes one call to Cloudflare’s Clef classifier (@cf/cloudflare/clef-flash) with those rules and a description of the call. Clef returns a score for each rule; Smartplane turns the scores into a decision.
What the classifier receives about the call:
| Field | When it is sent |
|---|---|
| The rules being judged, as compiled prompts your administrators reviewed | Always |
| The caller’s role, team names, project and kind (member or service account) | Always |
| The caller’s email address, or a service account’s name | Only when a rule judging the call names people |
| The resource’s kind, name and description, and the tool’s name, title and description | Always |
| The tool call’s arguments, with credential-shaped values redacted and long values shortened | Always |
| Whether the call goes through a shared account or the caller’s own | Always |
| The shared account’s identity (for example billing@ your company) | Only when a rule judging the call names that account |
| Who connected the shared account | Only when a rule judging the call names people |
| Labels and kinds of items a rule is pinned to, when the call touches them | When a pinned rule is judged |
The classifier never receives what the tool returns, because the check runs before the tool does. It never receives credentials, because Smartplane decrypts them only after every check has passed.
The scores, the decision and the reasons are written to your organisation’s audit log.
2. Writing and testing rules
When an administrator writes a rule in plain language and asks Smartplane to verify it, Smartplane uses a language model on Workers AI (currently DeepSeek V4.1 Flash, @cf/deepseek-ai/deepseek-v4.1-flash-1017) to write the classifier prompt, invent example calls that should and should not break the rule, and review the result. It then runs those example calls through Clef to test the prompt.
What this model receives: the rule’s wording, the names of your organisation’s roles and teams, the names and descriptions of resources the rule mentions, and the names and descriptions of their tools (from the tool’s own listing or from Smartplane’s catalog). It does not receive member names or email addresses: which people a rule names is worked out locally, without a model. If an administrator types a person’s name into the rule itself, that wording is sent as written.
If a rule names a specific item (for example a folder), the model may also pick one read-only tool and its arguments so that Smartplane can look the item up. That lookup runs through the gateway as the verifying administrator, under their grants and your rules, and is audited like any other call. The items it finds are shown to the administrator to confirm and are matched without a model.
Nothing a model writes takes effect on its own. A compiled rule stays inactive until an administrator reviews and activates it, and the call filter verification suggests applies only after an administrator accepts it.
3. Scanning skills (off by default)
Smartplane can scan skill files your organisation adds for risky instructions, such as prompt injection or attempts to send data elsewhere. Scanning is off unless it has been switched on for the deployment. When it is on, Clef receives the skill’s SKILL.md and its scripts and answers a fixed set of yes-or-no questions. If Clef is unavailable, the scan is recorded as not done, never as passed.
Who runs the models
| Model | Used for | Run by |
|---|---|---|
Clef Flash (@cf/cloudflare/clef-flash) | Call-time rule checks, rule tests, skill scanning | Cloudflare Workers AI |
DeepSeek V4.1 Flash (@cf/deepseek-ai/deepseek-v4.1-flash-1017) | Writing, reviewing and testing rules | Cloudflare Workers AI, which hosts the open model itself |
Cloudflare’s terms state that it does not create or train the third-party models it hosts, does not use Workers AI content to train models, and does not make your content available to other Cloudflare customers. It may keep operational metadata, such as timestamps, token counts and error codes, without the content. We will update this page, and our Subprocessors page if the provider changes, before using a different model provider.
What rule checks can and cannot do
Classification is probabilistic. A model can score a harmless call as breaking a rule, or miss a call that breaks one, especially when the call’s arguments are ambiguous or a rule is broad. Smartplane is built so that these limits fail safely, but you should treat guard rules as a strong safety net, not as a guarantee.
- Enforcing rules fail closed. If the classifier cannot be reached or does not answer, and an enforcing rule or an approval rule applies to the call, the call is denied.
- Monitoring rules never block. A rule in monitor mode only flags calls in the audit log, and never blocks a call, even when the classifier is unavailable.
- Approval rules need a person. A call held for approval runs only after someone other than the requester approves it.
- Grants come first. Whether a person may use a tool at all, which tools and which argument values, is decided by grants, in code, without AI.
You remain responsible for what your agents do and for reviewing your rules, your grants and your audit log. See our Terms of Service.
What is kept
Cloudflare does not keep model inputs or outputs after a request, according to its terms. Smartplane keeps: the compiled rule prompts and verification results, the example and test calls an administrator saves, and, in the audit log, each call’s arguments, scores and decision. These follow the retention periods in our Privacy Policy.
Your choices
- An organisation with no active guard rules sends nothing to a model at call time.
- Rules can be scoped to specific resources and tools, so the classifier sees only the calls they are about.
- Writing rules about teams and roles rather than named people keeps email addresses out of the classifier.
Questions about this page: privacy@smartplane.dev.