AI consent & privacy

Before Lar sends anything to an AI model, it asks you. You can approve a single request, allow a kind of request for the whole workspace, or keep a private journal out of AI entirely, and every request lands in a local activity log you can review.

AI is optional. Editing, full-text search, Types, TQL, and Workflows without AI steps all work with no model provider.

Where requests go

A request goes to exactly one destination:

The server’s AI service. This is the default for a new workspace, and the only option in the browser and mobile apps, which cannot hold a provider key safely. The consent dialog names it as Lar or the server’s provider.
A cloud provider with your own key. On desktop you can choose Anthropic, OpenAI, Gemini, or xAI instead. The provider receives the text Lar sends for that request. Setup is covered in AI assistant & actions.
Ollama on your own computer. Optional semantic search on desktop builds its index with a local Ollama model, so that text stays on your machine. Downloading or updating the model can still contact its vendor.

Approve a request

Before a request leaves the device, Lar asks Allow this AI request? The dialog shows:

the Destination (the service or provider),
the model, and
the Action that wants to send, such as editor.summarize.

Choose Deny or Allow & send. Keyboard focus starts on Deny, so pressing Enter by reflex never sends anything. When several requests arrive at once, the dialog shows them one at a time.

Allow a kind of request for the workspace

Tick Always allow <action> in this workspace before you choose Allow & send. Lar then stops asking for that action in this workspace. Other actions and other workspaces still ask.

Standing consent has limits:

If a later request is much larger than the one you approved (more than four times the size, or over 2,000 characters more), Lar asks again. This stops a short approved chat turn from covering a much longer conversation later.
It does not hide anything: every request is still recorded in the activity log.
For the local Ollama model, ticking the box once allows every local request in the workspace, since nothing leaves your computer.

An automatic Workflow with an AI step needs standing consent for every kind of AI step in it. Without that, a match becomes a suggestion that waits for you instead of sending content on its own.

Exclude an Object

Open the Object’s ⋯ menu, point to AI, and choose Exclude from AI. Lar enforces this where AI reads your data, not just in the interface: AI Chat context, semantic indexing, Workflow AI steps, and the MCP tools that AI agents use all skip the Object. A whole Type can also be excluded.

Exclusion does not remove content already sent to a provider. Check that provider’s retention policy for anything already sent.

Keep out of automatic AI context is a lighter option in the same menu: automatic context skips the Object, but you can still @-mention it or pin it to a chat deliberately.

Web search and tools

With Anthropic as the provider, AI Chat can use workspace tools to search, open Objects, run queries, and list backlinks, and the conversation shows each lookup. These tools read your workspace only; they do not send extra requests outside the chat.

Web search is different: it sends queries derived from your conversation to the provider’s web search. It stays off until you turn on Allow web search in AI chat under Settings → AI provider → Web search, and it works only with a provider that supports it, currently Anthropic.

Review and revoke

On desktop, Settings → AI provider → Activity lists the 20 most recent AI requests with the action, model, outcome (ok, denied, or error), token counts, and time. Tool calls from connected AI agents appear here too, prefixed mcp..
The provider’s spending cap in the same section limits estimated tokens per day.
Choose Remove next to the API key to delete it from the keychain.
Turn off web search, or remove your keys, to stop AI without affecting the rest of your workspace.

Next: AI assistant & actions.