Finetic Operator: Privacy, Security and Action Boundaries

Optional, administrator-controlled assistance#

Finetic Operator is an optional assistant for investigating one Finetic server. It remains hidden unless an administrator both enables it and supplies a usable server-side OpenAI credential. Finetic does not ship an API key, silently enrol an installation or send background conversations to OpenAI.

Operator is designed as a confirmation-before-action system. The model receives a bounded text request and returns structured advice or a proposed action. It does not receive direct access to Finetic, PostgreSQL, the media filesystem, a shell or the public internet. A proposed action is executed only by Finetic's own server code after an authorised administrator explicitly confirms it.

What exact information is sent to OpenAI?#

Each question creates one bounded request containing:

1. Finetic's fixed Operator instructions and the allowed response schema;
2. the administrator's current question, after pattern-based removal of paths, URLs, email addresses, network addresses and long secret-like values;
3. at most six recent messages from that administrator's selected saved conversation, passed through the same text cleaner; and
4. a fresh redacted operational snapshot covering playback evidence, system health, library activity, jobs and tasks, remote-access checks, backups and updates.

The operational snapshot can contain safe states and measurements such as counts, percentages, durations, versions, route names, job states, timestamps and typed failure categories. Finetic deliberately removes fields whose names indicate identity, media titles or identifiers, usernames, email, installation or device identity, credentials, cookies, URLs, endpoints, IP addresses, filesystem roots and backup or database paths.

The model is also given an allow-listed JSON response schema. This limits responses to an answer, findings, links to known Finetic administration views, bounded limitations and up to three proposed actions.

Finetic does not intentionally send media files, artwork, subtitles, lyrics, database contents, API keys, passwords, session cookies, licence keys, full user records, media titles, provider identifiers, source paths, private hostnames or installation identifiers in the operational snapshot.

The OpenAI credential is used to authenticate the server-side request. It is not inserted into the prompt or saved conversation.

How are prompts and responses redacted?#

Redaction has two layers:

• Field removal: snapshot keys matching sensitive concepts are omitted before serialisation. This includes names, titles, media and user identifiers, paths, URLs, endpoints, addresses, tokens, passwords and credentials.
• Text cleaning: remaining strings, the administrator's question, recent conversation text and model output are cleaned for IPv4 addresses, Windows and Unix-style paths, HTTP(S) URLs, email addresses and long secret-like strings.

Requests are also bounded: the current question is limited to 1,000 characters; at most six previous messages are included; snapshot arrays, object breadth, nesting depth and string length are capped. The reply is parsed as JSON and its text fields, routes, action names and parameter values are checked again before Finetic accepts it.

Redaction is a safety control, not a mathematical guarantee. An administrator can still type a private media name or unusual identifier that does not match a redaction rule. Avoid putting information in an Operator question that you would not send to OpenAI.

Where are saved conversations stored?#

Saved conversations remain in the installation's PostgreSQL database. Finetic stores:

• the conversation title and owning administrator ID;
• user and assistant messages;
• the structured answer and findings;
• proposed action type, bounded arguments, confirmation state and result; and
• created, confirmed and completed timestamps.

Conversation queries are scoped to the owning administrator. Another administrator cannot open a conversation merely by knowing its ID. Deleting a conversation deletes its saved messages and action proposals through database relationships. Full Finetic backups can contain these database records, so backup access and retention should match the privacy expected for administrator conversations.

Finetic does not persist an OpenAI thread ID and does not use OpenAI as the source of truth for saved chats. Local retention and OpenAI's provider-side retention are separate.

Can malicious media metadata influence Operator responses?#

Finetic removes media titles, media IDs, names and paths from the snapshot, which prevents the most obvious metadata from becoming instructions. Operator also tells the model that administrator and conversation content is untrusted, disables browsing and tools, uses a temporary empty working directory and runs the Codex sandbox read-only with no approval capability.

However, no prompt-injection defence is absolute. A diagnostic or failure string that survives the field and pattern filters could still influence the wording of an answer. The important containment boundary is that the model cannot directly act: it can only return structured text and a proposal from a fixed allow-list. Finetic validates that proposal, shows it to the administrator and requires confirmation before the server executes anything.

Treat Operator findings as assistance, not as an authority. Review the referenced Finetic page and the proposed effect before confirming an action. A complete pre-transmission request preview and additional untrusted-diagnostic hardening are tracked as product work.

What actions are available?#

Operator can also recommend a known administration view without changing anything. It cannot delete media, change users or permissions, reset passwords, reveal credentials, edit arbitrary configuration, run shell commands, browse the web or execute an action outside this list.

How are action arguments validated?#

An action passes through several independent checks:

1. OpenAI must return JSON matching Finetic's response schema and action enum.
2. Finetic re-validates the action type and converts arguments into named allow-lists. Unknown task IDs, job kinds and routes are discarded.
3. The proposal is stored against the requesting administrator and starts as pending.
4. The action endpoint requires the appropriate Finetic security permission, ownership of that proposal and an explicit confirmed: true request.
5. A proposal can be claimed once. Duplicate confirmation is rejected.
6. The executor re-checks relevant live state—for example, an update must exist, be installable and already verified before installation; active playback blocks an update install; and remote checking requires a configured public address.
7. Completion or failure is saved and a security-audit event is recorded.

OpenAI never receives a general-purpose Finetic action tool. It proposes a small data object; Finetic remains the policy and execution boundary.

Can an administrator inspect the complete request before transmission?#

Not yet. The administrator can inspect the question, the recent saved conversation and Finetic's category-level disclosure, but v0.2.4 does not provide a preflight view of the complete generated instructions and redacted snapshot.

This is a known transparency limitation, not a hidden feature. Until a request preview exists, administrators who require exact per-request inspection should leave Operator disabled.

How are API keys encrypted or protected?#

Finetic supports two server-side credential patterns:

• a key entered in Administration → Configuration → Finetic Operator is encrypted with AES-256-GCM before it is written to configuration.json; the separate 256-bit local encryption key and configuration document are created with owner-only file permissions; or
• a credential can be managed outside Finetic through a server environment variable or a dedicated credential file. Credential files are rejected when group or world permissions are present.

Secret settings are write-only in the web API: browser responses expose only whether the value is configured. The original value is never returned to the browser, copied into saved conversations or included in the operational snapshot. Environment-managed values cannot be overwritten through the configuration page.

Local encryption protects against accidental plaintext disclosure; it is not a hardware security module. A person with root access, access to both the encrypted document and its local key, or the ability to inspect the running server process can recover a configured credential. Protect the host, PostgreSQL backups, Finetic data volume and administrator accounts accordingly. Use a dedicated OpenAI project key with appropriate spend controls, and rotate it if the server or a backup is compromised.

No Finetic API key or Young Studio credential is included in the public Docker image, Compose examples or downloadable runtime archives.

OpenAI's provider-side data boundary#

OpenAI states that API data is not used to train or improve its models unless the API organisation explicitly opts in. Its default abuse-monitoring logs may retain prompts and responses for up to 30 days, subject to legal and safety exceptions. The Responses API can also retain application state under its default settings; eligible organisations can apply approved retention controls.

Those provider controls belong to the OpenAI project attached to the administrator's credential, not to Young Studio. Review OpenAI's current API data-controls documentation before enabling Operator.

Safe enablement checklist#

• Use a dedicated OpenAI project credential rather than a personal all-purpose key.
• Set project spend and access controls in OpenAI.
• Read one Operator request as if it will leave your server—because it will.
• Keep questions free of private titles, addresses and credentials even though Finetic applies redaction.
• Review every action effect before pressing Confirm and run.
• Delete saved chats that should not remain in PostgreSQL or Finetic backups.
• Leave Operator disabled when the provider boundary or current lack of complete request preview is unsuitable for your household.