> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mythicsage.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Chat channel configuration

> Creating a Sage chat channel: what each field in the New AI Chat dialog does, and how to keep credentials out of plaintext.

You create every Sage session through Mythic's **New AI Chat** dialog, choosing the `Sage` model.
This page walks the dialog's fields and the decisions in them. The authority-mode semantics
behind the Mode field are covered in [Authority modes](https://docs.mythicsage.ai/understand/authority-modes.md); how values
resolve against secrets and environment variables is covered in
[Environment and configuration](https://docs.mythicsage.ai/configuration/environment.md).

> [!NOTE]
>
> Create a dedicated Mythic bot API token for the chat channel instead of pointing it at your
> operator account. Mythic v4 issues bot tokens, and using one keeps attribution clear: tasks
> Sage issues are visibly the bot's, not yours. The channel token needs `apitoken.write` (to
> generate the scoped tokens the channel tools use) and `chat-ai.write` (to stream responses back
> to the channel). Guarded tools additionally need `callback.write`, `payload.write`,
> `credential.write`, or `file.write`; a tool whose scope the token lacks is disabled up front.
> See [Scope preflight](https://docs.mythicsage.ai/reference/tools-and-capabilities.md#scope-preflight).

![The AI Chat API Token panel listing the apitoken.write and chat-ai.write scopes, with Owner and API Token selectors](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/api-token.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=704119c7af77069a71aadd8bcc416b99)

The AI Chat API Token panel at the bottom of the dialog. Choose your operator account or the operation bot as Owner, then pick or create a token that carries both required scopes. The bot name is redacted.

## Channel fields

The top of the dialog holds Mythic's own chat fields, not Sage's: a **Name**, a **Description**,
and the **Model** selector where you pick `Sage`. A `Sage Watcher` model is also listed; that is
the separate findings-watcher profile documented in
[Background findings watcher](https://docs.mythicsage.ai/guides/findings-watcher.md), not a second assistant.

![The New AI Chat dialog's Type, Name, Description, Container, and Model fields](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/channel-fields.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=c58470ff017b0a151ac5dbe1d29f30f3)

The top of the New AI Chat dialog, with the sage container and the Sage model selected.

## Advanced configuration

Everything below is Sage's own configuration, declared in
`Payload_Type/sage/sage_chat/models.py`. Nothing is mandatory: a fresh channel with no fields set
runs as a read-only conversation using the provider defaults.

> **Model selection**
>
> | Field | What it does |
> | - | - |
> | Provider | Which model provider to use: OpenAI (default), AWS Bedrock, Anthropic, or Ollama. Bedrock uses the AWS quad below; the others use API Key / API Endpoint. |
> | Model | The model name for that provider, for example `gpt-5.5-cyber-preview` or `claude-sonnet-5`. |
> | Reasoning Effort | Optional OpenAI-compatible reasoning setting, from None up to Maximum. Blank uses `SAGE_REASONING_EFFORT` from the environment if set, otherwise the provider default. |
> | Provider Retry Policy | Optional OpenAI-compatible retry preset. Off uses the provider SDK defaults; Transient v1 retries confirmed temporary 429 and 503 responses with bounded waits. Blank uses `SAGE_PROVIDER_RETRY_POLICY` from the environment if set. |
>
> ![The AI Configuration fields: Provider, Model, Reasoning Effort, and Provider Retry Policy](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/model-selection.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=e78a6acf74a27ae724e3733c2c9af500)

> **Authority**
>
> | Field | What it does |
> | - | - |
> | Mode | Conversation (default) is read/response-only and cannot execute external tools. Supervised permits model-proposed guarded work only after exact operator approval. Autonomous runs the execution kernel unattended. |
> | Autonomous Solve | Force deterministic multi-hop solving for this session. In supervised mode, controller moves still require approval and completion requires objective evidence. Off keeps supervised requests on the scoped graph workflow. Mode=Autonomous always enables objective solving. |
> | Policy | Hybrid (default) has the model select from the complete deterministic admissible frontier at real branches or after supervised Respond guidance. Symbolic keeps deterministic first-admissible selection and cannot interpret Respond guidance. LLM calls the model on every nonempty frontier. |
> | Max Steps | Global cap on model steps for this run; halts a runaway loop. Defaults to 200; 0 means unlimited. |
>
> ![The Mode, Autonomous Solve, Policy, and Max Steps fields at their defaults: Conversation, off, Hybrid, and 200](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/authority.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=c3ded7e5159c5faf487409d47a4afc2b)

> **Behavior**
>
> | Field | What it does |
> | - | - |
> | System Prompt Override | Optional override for Sage's default operator-assistant system prompt. For the per-agent prompt files, see [Tools and capabilities](https://docs.mythicsage.ai/reference/tools-and-capabilities.md#extension-points). |

> **Credentials**
>
> These resolve field first, then user secret, then container environment. Leaving them blank and
> storing them as Mythic user secrets keeps them out of plaintext channel config; see
> [Environment and configuration](https://docs.mythicsage.ai/configuration/environment.md) for the full chain.
>
> | Field | What it does |
> | - | - |
> | API Endpoint | The endpoint for the selected provider (non-Bedrock). |
> | API Key | The key for the selected provider. Stored in plaintext channel config if entered here; to keep it hidden, leave blank and set the `API_KEY` user secret instead. |
> | AWS\_ACCESS\_KEY\_ID | Bedrock access key ID. |
> | AWS\_SECRET\_ACCESS\_KEY | Bedrock secret access key. |
> | AWS\_SESSION\_TOKEN | Bedrock session token. |
> | AWS\_DEFAULT\_REGION | Bedrock region. |
>
> ![The credential fields: API Endpoint, API Key, and the four AWS Bedrock fields, all left blank](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/credentials.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=b0885b6053b8a5692218e28d57396efc)

> **BloodHound**
>
> | Field | What it does |
> | - | - |
> | BloodHound URL | Where BloodHound CE is, as one address: `http://host:port`. Must be an address only: a path, query, fragment, or embedded credentials are refused rather than trimmed, so pasting a browser URL like `http://host:8080/ui/login` tells you what to remove. |
> | BloodHound Token ID | BloodHound CE API token ID. Stored in plaintext channel config if entered here; use the `BLOODHOUND_TOKEN_ID` user secret to keep it hidden. |
> | BloodHound Token Key | BloodHound CE API token key. Same plaintext caveat as the token ID. |
>
> These are resolved in the chat config because the BloodHound MCP server is launched as a
> subprocess that receives only a fixed safe subset of Sage's environment, so a `BLOODHOUND_*`
> variable set on the container never reaches it by inheritance. Leave every field blank to keep
> the server's own directory `.env` as the source of truth. Connection details are in
> [BloodHound](https://docs.mythicsage.ai/guides/bloodhound.md).
>
> ![The BloodHound URL, Token ID, and Token Key fields, all left blank](https://mintcdn.com/self-dbca2498/csYWoXextNaA1ISz/assets/new-ai-chat/bloodhound.png?fit=max\&auto=format\&n=csYWoXextNaA1ISz\&q=85\&s=05575a16c0e0a65ce5a3372e4e524bd4)

## Watching a channel

The chip row above the transcript reports the live configuration and connection state: provider,
model, mode, policy, Max Steps, tool counts, BloodHound and MCP connectivity, and the round count.
You can set the same fields mid-engagement with the pencil icon on the channel header; see
[Reading the chips](https://docs.mythicsage.ai/guides/using-chat.md#reading-the-chips).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.