Configuring a model provider

Roko Platform agents run on models from a provider that you configure per project. The project's Settings → Models page decides where the models come from and which ones agents may use. An agent's definition names no model, so nothing else on the platform decides this.

Background

A project has at most one model provider. Until it has one, it runs no Platform agents: Agents is absent from the project's sidebar, and an implementation can only be done locally, by a person with their own agent. Your own agent, connected over MCP, uses its own model and does not need this setting.

The platform supports two provider kinds:

A deployment chooses which provider kinds it offers. Amazon Bedrock is on by default, and Azure OpenAI must be enabled for the deployment. The platform has no direct Anthropic API or OpenAI API provider.

Credentials

By default, the agent pod authenticates as the deployment's own cloud identity, and the platform stores no model credential. A new provider must use the cloud identity. The platform refuses a new provider with a static access key.

An older provider may still hold an access key. Its card shows two tabs, Cloud identity · Recommended and Access key · Discouraged. Select Switch registered models to cloud identity to move it over.

Where the platform does store a secret, it encrypts it before it writes it to the database and never shows it again.

Which runs use it

Every Platform agent run uses the project's provider: implementation runs, change request reviews, scheduled agents and the other agents on the Agents page. The platform picks the model for a run in this order:

1. The model chosen when the implementation started, if the run belongs to one.
2. The model set for that agent on the Agents page, with Edit model.
3. The project's default model.

The platform records the model on each run when it creates the run. Analytics and reporting make no model calls.

Configure the provider

1. Open the Models settings

   Open the project's Settings page from the top bar and select the Models tab.

2. Add the provider

   Under Provider, choose the provider kind and fill in its settings, for example the Region for Amazon Bedrock. When the deployment offers only one kind, the form names it instead of offering a choice. Select Save provider. The card then shows This deployment's cloud identity and No model credential is stored.

3. Find and test a model

   Under Available models, the Models available through cloud identity card lists what the provider can reach. Search for a model, or enter an exact model ID, and select Test. The platform sends the model the message "Who are you?" and shows the answer.

4. Register it

   Select Register. The model appears under Registered models. Agent settings and implementation kickoffs can choose only from this list.

5. Choose the default

   Select Make default on the model that agents should use when nothing else names one. The row shows Default.

To stop agents using a model, turn off its Registered switch. The model is then Deregistered: agents and new runs can no longer choose it, and existing run history stays as it is.

Best practices

• Use the cloud identity. It keeps model credentials out of the platform, and it is the only option for a new provider.
• Test before you register. A model the account cannot call fails every run that picks it.
• Register a short list. Register the models you want agents to use, and deregister the ones you have moved away from.
• Choose a capable default. Most runs use the default. Set a different model per agent on the Agents page only when an agent needs one.
• Watch cost per run. The platform records the cost of each run, and the Agents page shows it. The platform has no cost budget setting, so choose the default model with cost in mind.