Add semantic tenant review without managing another API key.
Managed Fireworks review is an optional paid Cloud capability. BoundaryCI keeps its provider credential server-side, checks customer authorization before migration text leaves the runner, and returns schema-constrained findings to the existing report.
Start with an eligible Cloud organization
Managed review is included with Team, Growth, and Enterprise. Free organizations continue using the deterministic checks and can still upload minimized findings to Cloud history.
Only an organization owner or administrator can authorize managed review. Existing organizations remain off until a manager accepts the disclosure.
Authorize once in the dashboard
Open the BoundaryCI dashboard, locate Managed Fireworks AI, review the data-handling disclosure, select the authorization checkbox, and choose Enable managed AI review. The authorization time is recorded for the organization.
After organization consent, each active repository starts enabled. Repository switches let managers keep selected projects deterministic-only without disabling the organization-wide capability.
Use the generated workflow
The permanent Setup guide includes managed-fireworks set to true. No FIREWORKS_API_KEY secret is required: the runner uses its repository-bound BOUNDARYCI_CLOUD_TOKEN to check eligibility and request the fixed semantic review.
yaml managed-fireworks: "true"
upload: "true"
cloud-url: YOUR_BOUNDARYCI_INGEST_URL
cloud-token: ${{ secrets.BOUNDARYCI_CLOUD_TOKEN }}Understand exactly what is transmitted
The runner first sends only repository identity to check the paid plan, subscription, organization consent, and repository setting. Migration text is not included in that eligibility request.
Only after an enabled response does the runner redact common token, JWT, password, secret, and API-key patterns and send up to 80,000 characters of migration text. BoundaryCI forwards that text to Fireworks and does not store the migration input. It stores the normalized review result, model, status, input hash, and bounded operational metadata; completed scan uploads also include the result in Cloud history.
Keep deterministic checks in control
Managed AI findings are advisory by default. Fireworks unavailability, rate limiting, or an invalid model response produces a warning while deterministic scanning and Cloud upload continue.
Teams can explicitly include AI findings in the exit decision through boundaryci.config.json, but should do so only after measuring the finding quality on their own repositories.
Opt out at any layer
An owner or administrator can disable managed review for the organization or a single repository in the dashboard. A repository can also bypass it in workflow YAML. Local scans without Cloud upload never request managed review.
yaml managed-fireworks: "false"Bring-your-own-key remains available
Advanced users can continue running boundaryci scan --fireworks with their own FIREWORKS_API_KEY. When that direct mode is selected, the request goes from the customer environment to Fireworks and BoundaryCI does not also request the managed review.