Control plane reference

Mind Platform

Mind Platform is the account and control surface for Mpalo API identity, storage connections, API keys, usage, and billing. It configures access to the memory infrastructure. It is not a second memory runtime.

Current boundary.

The hosted customer path is a production-shaped deterministic mock. Mind Platform actions use the authenticated account boundary. A memory operation still needs a customer API key attached to an active storage connection and the applicable private-memory consent. Only model-dependent output is substituted in the current runtime. Storage, usage, test-environment billing, and observability use the backend path.

Credentials and authority

A browser session and a customer API key serve different purposes. The CLI chooses the appropriate credential for a command, but a saved session does not silently become an API key.

Credential	Use	Boundary
Browser session	Sign in, inspect identity, manage account resources, and read allowed control-plane or infrastructure views.	Short-lived session state. Not sufficient for memory writes or other API-key-only data-plane operations.
Customer API key	Authenticate application memory operations and the tenant-scoped usage path.	The key must be attached to an active memory-storage connection. The secret is shown only at creation.
Operator simulation capability	Authorize explicit adverse mock profiles such as forced latency or failure.	Not needed for ordinary backend-backed mock calls. It must not be treated as customer access.

The service derives tenant, user, organization, and API-key scope from the verified credential. Caller-attested source metadata, namespaces, and request IDs do not widen authority.

Storage connections

A key is not complete until it has an active memory-storage connection. The simplest current choice is Palo Managed Memory. Its acceptance concerns storage and retrieval of submitted memory data. It does not authorize training or aggregate learning.

Connection state	What Mind Platform can do	What memory operations can do
Active `mpalo-memory`	Create, list, edit, delete, and attach the managed connection according to account permission.	Enter the current managed text path after authentication, consent, and policy checks.
Active custom or BYO	Represent configuration metadata for a future provider.	Fail closed with `MEMORY_STORAGE_PROVIDER_UNAVAILABLE` before data, retrieval, deletion, metering, or billing work.
Missing or inactive	Show the resource state and allow an authorized setup or correction.	Reject the operation. The runtime never invents an implicit storage destination.

See Storage and providers for the current control-plane-only BYO boundary and future adapter requirements.

API-key lifecycle

API keys are credentials for applications, not model configuration records. The current creation flow asks for a name and storage attachment. It does not require a Palo model selection because the hosted runtime chooses model-dependent substitution at the operation boundary and reports that fact in provenance.

Action	Current behavior	Safe automation rule
Create	Requires a name and active storage attachment. The full secret is returned once.	Store the secret in a secret manager immediately. Do not place it in logs or source control.
List	Returns metadata such as name, prefix, state, storage attachment, and timestamps. It never returns full secrets.	Use the structured response for inventory and rotation planning.
Edit	Changes the human-readable name or description without changing the secret.	Use the key ID and send only fields that should change.
Revoke	Disables the key for future authentication while preserving the redacted history required for accountability.	Require the exact key name for interactive destructive confirmation.

No universal model selector.

Compatibility fields such as palo_variant or default_model may appear in older records. They are metadata only in the current v1 path. A successful key creation does not prove that Palo Bloom, Palo Nano, embeddings, or an external provider is running.

Usage, limits, and billing

Mind Platform reads the same backend-ledger family used by the infrastructure views. Request history, operation measurements, charge events, pricing versions, and billing status are related by request correlation but remain separate records.

Usage

Accepted customer API activity, request quality, operation stages, and measured units for the selected account or organization scope.

Limits

Account, organization, team, or user controls that can constrain calls. A limit response is not a usage event.

Charges

Operation-level records with pricing and environment state. Backend-backed mock charges are recorded in the configured test environment.

No data

Absence of samples is represented as no_data with null measurements. It is not silently converted into zero activity.

The current mock path can exercise persistence, metering, billing, export, deletion, and monitoring. It does not make a learned model or production billing claim. Explicit offline client fixtures contact none of these surfaces and are not billable.

Billing failure contract.

Billing control-plane failures return an HTTP status, a human-readable error, and a stable code. Client errors preserve the action the account needs to take. Server and provider failures use safe customer-facing text instead of returning raw Stripe or internal exception details. A capability that is not released returns 501 with an explicit unavailable code rather than a successful placeholder.

CLI and SDK control

The CLI and Python SDK use the same Mind Platform routes and response meanings. Humans can use the designed terminal view. Agents and CI should request JSON and preserve request IDs instead of scraping presentation output.

palo auth
palo mind me --json
palo mind storage list --json
palo mind keys list --json
palo mind usage summary --json
palo mind billing subscription --json

Use Palo CLI for interactive and shell workflows, or Python SDK for typed application code. Use HTTP reference when implementing another client.

What Mind Platform does not establish

Account state	Not implied
Storage connection exists	That its provider is executable, compatible, encrypted, reachable, or authorized to receive data.
API key exists	That it selected a model, created an embedding, enabled external LLM execution, or bypassed consent.
Usage or charge row exists	That Palo Bloom ran. Model execution, storage, metering, billing, and observability are independently attributable.
Browser session exists	That a customer data-plane operation may use it in place of an API key.

For the complete storage, provenance, export, deletion, and model boundary, read Data boundaries and provenance.

Was this page helpful?

Your feedback helps us improve our documentation.