Skip to Content
Known Limits

Known Limits

This page is a quick index of the boundaries developers most often need to plan around. The full coverage and non-claim model lives on Scope and Limits.

Provider coverage

Provider operation coverage is not uniform. OpenAI has the broadest operation coverage; other providers focus on text generation and streaming with narrower coverage for advanced operations. See Provider Support and Scope and Limits § Provider coverage.

Routing

Routing is explicit and recorded; Keel does not perform autonomous fleet-wide selection. See Routing and Scope and Limits § Routing scope.

Replay and idempotency

Replay and idempotency guarantees are route-dependent — proxy routes have the strongest same-key replay binding; other routes are narrower. See Idempotency and Scope and Limits § Replay and idempotency.

Permit-first observation

When the caller executes downstream of POST /v1/permits, Keel records the decision but does not directly observe the provider call. Use the verification track to attach receipt evidence, or use a Keel-managed execution route when execution-bound enforcement matters. See Scope and Limits § Permit-first observation boundary.

Read/write governance coverage

Read/write governance applies to actions that route through Keel: model calls, managed MCP :call invocations, Stripe MPP/x402 payments, exact Work connector requests, and configured Vocal Bridge outbound calls. GitHub, files, email, Slack, customer data, cloud, database, and code tools are Keel-enforced only when they are invoked through an enrolled managed MCP contract. That includes the exact stripe.refund.create contract as a beta/limited Stripe TEST path: Keel owns dispatch to the enrolled server, while the customer adapter owns the final Stripe call and TEST credential. It is not a general or live-mode Stripe refund claim, and revision-bound automated certification is pending. The MCP decide and prepare routes do not call upstream and require external enforcement. Browser/computer-use and the session code-execution adapter are not released managed-execution claims; the mounted browser and code routes dispatch only through an explicitly configured executor and, with none configured, return 503 without dispatching. Direct off-path calls made with the agent’s own credentials are outside Keel’s governance boundary. See Read/Write Governance and Scope and Limits § Read/write governance coverage.

Accounting precision

For complex multimodal traffic, pre-dispatch budget decisions can rely on heuristic token estimates and reconciliation closes the gap. When provider-final usage is missing, terminal accounting can remain estimated. See Scope and Limits § Accounting precision.

Content inspection

The Prompt Firewall is a deterministic detection layer for well-defined risk patterns, not a semantic prompt-injection defense. Coverage is route-scoped. See Prompt Firewall and Scope and Limits § Content inspection.

Trust tier differences

Audit and integrity features have a plan-tier ladder. See Trust & Integrity and Plans & Entitlements.

Out of scope today

  • Realtime session APIs are documented but are not part of the official stable route inventory; their media and sidecar paths are evidence/decision surfaces, not a blanket voice-execution gate.
  • Operator deployment internals.

See Scope and Limits § Out of scope today.

What to rely on

  • Permit-first remains supported when the caller must retain provider transport.
  • Public routes and request contracts documented on this site are the supported integration surface.
  • Route-specific guarantees are intentional; do not generalize across surfaces.
  • Undocumented behavior should not be treated as stable.
Last updated on Edit this page on GitHub 
Scope and LimitsRequest Lifecycle