The AI assistant
Describe what you want and have it drawn, or ask for changes to the diagram in front of you. The assistant edits the real canvas, so everything it does is undoable and reviewable.
Opening the assistant
Section titled “Opening the assistant”View ▸ Show AI Chat Panel (⌃⌘A) opens the conversation panel on the left of the window. Drag its inner edge to resize it.
Setting up a provider
Section titled “Setting up a provider”Open Rivoli Diagrams ▸ Settings… (⌘,). The Provider tab lists your configured credentials. Use + to add one and − to remove it; the filled circle marks the one in use. Selecting a row shows its API Key and Model: leave the model blank to use the default.
You can keep more than one credential (a personal and a work key for the same provider, say), give each a name, and switch which is active without re-entering anything.
Where the key in use comes from
Section titled “Where the key in use comes from”Settings names the source of the credential the assistant is actually using:
| Source | What Settings shows |
|---|---|
| A key you entered | “A key is saved in your Keychain”, with the last four characters so you can tell which one it is. A key from signing in says so instead. |
OPENROUTER_API_KEY in the environment | A read-only row naming the variable. It takes effect at launch and cannot be edited or removed here; it is used only when no saved credential is active. |
| Neither | “No key: running offline (mock)”. |
Verify checks the key in the text box when you have typed one, and otherwise the credential the selected provider row already resolves to, so a stored key or one supplied by the environment can be re-checked without retyping it. A key that is stored but rejected is reported as rejected, not as missing.
Without a key the assistant runs against a built-in offline mock, so you can see how the panel behaves without sending anything anywhere.
Asking for something
Section titled “Asking for something”Type into the message box at the foot of the panel. Useful requests look like:
- “Draw the checkout flow: cart, address, payment, confirmation, with a failure branch off payment.”
- “Add a cache between the API and the database.”
- “Colour everything owned by the platform team blue.”
- “Lay this out left to right and tidy the connectors.”
The header shows which provider and model are in use and reminds you where data is sent.
Reviewing before it applies
Section titled “Reviewing before it applies”Proposed changes can be shown as a plan preview (a plain-language list of the operations the assistant wants to perform), which you accept or reject. Anything that does apply lands as ordinary diagram commands, so ⌘Z undoes it like any other edit.
Operations are grouped into capabilities, and policy can treat them differently: adding content, modifying content, deleting content, restyling, and re-laying-out the canvas. An organization can allow some and require review for others, for example, letting the assistant add freely while insisting a human confirms every deletion.
Controlling what is sent
Section titled “Controlling what is sent”The governance section of Settings decides how much of your diagram leaves the machine.
Context scope
Section titled “Context scope”| Scope | What is sent |
|---|---|
| Selected shapes | Only what you have selected: the narrowest option. |
| This page | The active canvas. |
| Whole document | Every canvas in the document. |
What travels for each shape is its label and shape kind, and that much is always included: there is no setting that sends structure without the words inside the boxes. The fields switches in Settings are permissions on top of that: shape notes, connector labels, table text and shapes on hidden layers are all off unless you turn them on. Of those, only Shapes on hidden layers changes what is sent today; the other three are recorded as permissions and reflected in the panel’s disclosure line, and the assistant does not yet send those fields either way.
Redaction of sensitive content
Section titled “Redaction of sensitive content”Before anything is sent, the context is scanned for classes of sensitive data and handled per class rather than all-or-nothing. Credentials, personal identifiers and customer data are redacted by default; other classes, such as internal hostnames or confidentiality markings, can be set to warn or allow. Rules are data, so an organization can add patterns of its own (an internal customer-ID format, say) without a new build.
Retention and stored data
Section titled “Retention and stored data”Settings lists exactly what the assistant keeps and where: the API key in the Keychain, preferences, conversation and activity data in Application Support, and anything recorded in the document itself. You can set how long conversations and the activity ledger are kept, and delete stored artefacts on demand.
The activity ledger
Section titled “The activity ledger”Every request and every applied change is recorded, so you can audit what the assistant was asked and what it did to the document.
Managed policy
Section titled “Managed policy”If your organization deploys a managed policy, Settings shows it read-only with a banner. The effective rules are the strictest combination of the organization’s policy, the document’s, and your own preferences: you can tighten what your organization allows, never loosen it.
The Code Pane as an alternative
Section titled “The Code Pane as an alternative”If you would rather write structure than describe it, the Code Pane lets you edit the diagram as Mermaid text and apply it back to the canvas. Nothing leaves your Mac.