# FleetLume AI Notes

## Configuration

Open FleetLume AI as an owner or administrator. Enter the Gemini API key and select the model available to your Google AI project. The key is kept in `config/gemini.php`, protected by the existing config-directory access rules.

For servers where the config directory is read-only, define `GEMINI_API_KEY` in the server environment instead.

## Current AI tools

- Read-only operational assistant using small database summaries
- Customer/broker update drafting
- Risk and finance explanations
- HOS operational review with a compliance disclaimer
- Document extraction for rate confirmations, BOL/POD, receipts, invoices, challans, and border documents
- Fuel allowance review using the deterministic calculation as the baseline

## Safeguards

- API key never appears in client-side JavaScript or HTML
- CSRF validation on every AI request
- Role/permission checks
- Per-user hourly request limit
- File type and size validation
- Prompt hashes and usage metadata are logged, not full prompts
- Safe autonomous writes are limited to notifications and team tasks; all changes are logged and announced
- Database content is marked as untrusted context

## Production checklist

1. Confirm your Google AI billing, rate limits, and data terms.
2. Restrict access to the AI permission.
3. Keep the configuration directory outside the public document root where possible.
4. Use HTTPS.
5. Review extracted documents against originals.
6. Review Autopilot rules before enabling automatic safe actions.
7. Do not use AI output as an ELD certification, legal opinion, customs clearance, safety decision, or accounting approval.