Troubleshooting and privacy

Permissions

403 FORBIDDEN means your workspace role lacks the required permission (document:upload, agent:run, context_engine:manage, library:edit, library:approve, graph:review, agent_credential:manage, learning:manage, ask_history:manage, or structured:manage). Ask a workspace owner or admin to adjust your role. Never share a session cookie or password.

AI providers and model routing

Generation or embedding fails when the required provider key is missing (AI_PROVIDER_NOT_CONNECTED) or when a chosen model is not approved for the workspace data policy (MODEL_NOT_APPROVED). Every model choice (per-item or in Settings → AI models) is honored or refused—never silently swapped to another model. Only an owner or admin can connect or remove OpenAI, Anthropic, or Google keys in Settings → AI providers. On deployments where Amazon Bedrock serves chat, workspace choices run on the named provider while per-item agent or discovery choices are refused with MODEL_CHOICE_BEDROCK unless set to the workspace default.

Source, index, and Context Engine layers

A failed connection test means the read check did not succeed; for Google Drive (source_reauthorization_required), click Reconnect in Add Data or Settings → Connections with the same Google account. Extraction that stays in processing requires a running worker queue. Search with no hits often means the collection’s pinned embedding profile does not match the indexed vectors, or indexing has not completed. Open Context Engine (/platform/context-engine) or the collection’s Knowledge tab to inspect per-document reason codes (not_built, builder_updated, map_changed, stored_text_reversed, waiting_for_topology, budget_exhausted).

Quotas and restricted runtimes

Auth routes, workspace search, Context Studio, and /api/agent/v1 endpoints enforce rate limits (429 RATE_LIMITED with Retry-After). A non-retaining workspace refuses stored-only endpoints with 403 NON_RETAINING_WORKSPACE, and a non-retaining extraction returns PROCESSOR_UNAVAILABLE when its processor is unavailable. When escalating, send only the workspace id, collection id, run or request id, and the error.code.

Privacy

Support tickets and logs must never contain provider API keys, bdk_… agent tokens, connection passwords, document bytes, or answer text. Non-retaining results are never persisted on the server. In stored workspaces, private Ask history and governed agent memories belong solely to the member who created them, and Learning from questions redacts personal identifiers before storage when enabled by the workspace owner.