Skip to main content
AI Studio is the workspace-scoped development surface at https://ai.tuturuuu.com. It is a registered satellite app and uses the same workspace session, permissions, settings, and billing context as other Tuturuuu apps.

​
Workspace sections

Each section is its own route under /<wsId>; there is no catch-all section route. /logs used to render the same activity explorer as /runs and now permanently redirects there. Every observability filter — range, custom from/to, model, feature, status, and the expanded run — is stored in the URL, so a filtered view can be shared or bookmarked. Evaluations and experiments are not shipped. They are absent from navigation and routing until they have a backing implementation, rather than rendering a placeholder.

​
Access and issuance controls

Workspace members with use_ai_studio can review settled credit deductions, Studio-metered runs, provider cost, and the applicable personal or workspace credit status. Observability and execution do not depend on a global or workspace Studio enablement switch. Model execution still requires the requested model to be enabled and granted by the global catalog, workspace policy, plan, and credential scope. Ordinary callers must also have enough workspace credits and remain within request, budget, rate, payload, and abuse limits. Verified registered external apps keep their temporary zero-credit integration policy while remaining fully audited. Root administrators configure global defaults and workspace overrides in Infrastructure → AI Studio. Workspace administrators manage existing keys, retention, and model restrictions from AI Studio. Creating or rotating a ttr_ai_ key additionally requires a standing workspace grant from a platform administrator. Removing that grant blocks new issuance and rotation but does not revoke existing keys.

​
Model policy

/<wsId>/model-policy is the self-serve editor for the workspace row in private.workspace_ai_studio_policies. Members with use_ai_studio see the current policy read-only; manage_ai_policy is required to save.
  • Allowed models — empty means “no workspace allow list”; every model the platform catalog and the workspace plan permit stays callable. A non-empty list restricts execution to exactly those model ids.
  • Denied models — evaluated before the allow list, so a denied model is blocked even when it is also allowed.
  • Requests per minute and monthly credit budget — per-credential ceilings; leave empty for unlimited.
  • Capture, content retention, and metadata retention — leave on Inherit to follow private.ai_studio_global_settings. The editor shows the current platform default beside each field.
  • No training — keep enabled unless a signed agreement says otherwise.
The form enforces the same bounds as the PATCH schema (content retention 1–365 days, metadata retention 30–2555 days, rate 1–10000/min, budget above zero), so an out-of-range value is rejected before the request is sent.

​
AI-only keys

Studio keys use the ttr_ai_ prefix. The plaintext key is revealed once; only its SHA-256 digest is stored. A key is a workspace service credential, not a human session, and it cannot authorize non-AI Tuturuuu APIs. Keys can be limited by environment, model, expiry, request rate, and credit budget. Rotate or revoke a key immediately when its value may have been exposed. Never write plaintext keys to logs, database columns, issue trackers, or committed configuration. The key page remains available to workspace key managers when issuance is not approved so they can inspect and revoke existing credentials. Rotation is treated as new key issuance and is therefore approval-gated. Approved key managers can quick-create a development key from either the key page or Playground. The one-time secret can be handed to Playground through browser session storage; it is removed when read and is never sent through a dashboard URL or persisted by the Studio application.

​
Production Playground

Playground calls https://ai.tuturuuu.com/v1/models, /v1/responses, and /v1/chat/completions with the supplied AI-only key. It therefore exercises the same authentication, model policy, credit reservation and settlement, budgets, rate limits, abuse controls, and logging as an external production client. It does not use a privileged dashboard proxy. Text generation uses the AI SDK Google provider and the GOOGLE_GENERATIVE_AI_API_KEY configured on the AI Studio deployment. Public API, policy, and observability records keep the canonical google/... model ID; only the provider adapter receives the bare Gemini model name. Vercel AI Gateway credentials and routing are not used for this execution path. The workbench supports bounded AI SDK tool loops with the safe calculator and current-time demonstration tools. Tool loops are limited to eight model steps. The response shows a sanitized execution trace; the observability run table can expand that trace after settlement.

​
Metering lifecycle

Ordinary Studio keys and non-external callers follow one transactionally guarded lifecycle:
  1. authenticate the session or AI-only key;
  2. resolve the global, workspace, plan, and key policy intersection;
  3. reserve the maximum permitted credits;
  4. execute the provider call;
  5. persist the run and trace metadata; and
  6. settle exact provider usage and release unused credits.
Provider failures and aborted streams still settle billable usage. Runs record model, key, prompt or agent version, latency, first-token latency, token or media units, provider cost, billed credits, status, and a stable request ID. The dashboards combine these Studio runs with unmatched deductions from the shared AI credit ledger, so AI features outside Studio remain visible without double-counting deductions already linked to a run. Logs expose only sanitized metering fields, never raw prompts, outputs, tool payloads, or provider errors. AI SDK model and tool lifecycle callbacks additionally write ordered run steps. Each step stores its type, safe tool or model name, status, latency, token counts, and settled cost. Inputs, tool arguments, tool results, generated text, provider metadata, and unredacted errors are excluded from the step record. Registered external apps are the only temporary billing exception. Their short-lived token must include workspace:session plus ai:use or tts:use, the app must remain enabled and linked to the requested workspace, and the user must still be a current workspace member. These calls reserve no workspace credits, but they still enforce model and workspace policy, workspace request limits, abuse controls, payload limits, and full run/provider-cost auditing.

​
Trace retention

Run metadata is retained for 365 days by default. Prompt content, model output, tool arguments, and tool results are not captured unless the workspace explicitly enables content capture. Captured content defaults to 30 days and must be redacted before persistence. Customer AI content is not used for general-purpose model training by default. Provider-specific no-training and data-control options should be enabled when the provider supports them.

​
Curated tools

Agents can use only tools declared in the root tool catalog and explicitly enabled for the workspace. Tools must enforce workspace scope and normal Tuturuuu permissions. Arbitrary HTTP requests, undeclared data access, and code execution are not supported.

​
Local verification

Apply and test the private-schema migrations before running the app:
Then run the focused checks:
Keep model grants, budgets, rates, capture policy, and legal publication controls conservative while expanding API-key issuance workspace by workspace.