When the Estate was younger, we needed someone to mind the difficult door—the one through which certain categories of conversation must pass. We hired Dangermouse. He was a content classifier of the old school: suspicious of everything, possessed of an internal list of anxieties that grew longer by the week, and capable of exactly two responses—yes and no—with a marked preference for the second.

The trouble was that Dangermouse did not understand the difference between dangerous and delicate. A guest writing a war novel does not require a censor; they require a librarian who knows where the military history section is. A guest composing a difficult scene between estranged lovers does not need to be told that the Estate disapproves of raised voices. They need someone who understands that fiction is not autobiography, and that the writer’s intent is not the character’s crime.

The final straw involved a clergyman working on a theological monograph. He attempted to discuss a passage from the Song of Solomon in the context of ancient Near Eastern poetry, and Dangermouse flagged the entire conversation, reclassified the chat, applied a warning badge, and very nearly rerouted the good reverend to an entirely inappropriate alternative provider. The Foundryman’s language, when informed of this, could itself have been flagged.

Dangermouse collected his briefcase—the one full of flags and categories and anxiety—and walked out through the front gate without a word. He did not ask for a reference. The Concierge watched him go from the front desk, adjusted his pocket square, and turned to the next guest in the queue.

The Concierge operates according to your preference. There is no default assumption about what you should or should not discuss with your AI. There is only the question of how much help you want navigating the providers. What follows are the house defaults—the standing instructions he works to instance-wide. Every individual conversation may overrule them, and the per-chat switch described further down is where that is done.

Within his jurisdiction, every message receives one of three canonical verdicts: safe, flagged, or off. That is the reading of a single message, and it is a separate vocabulary from the per-chat switch further down, whose positions have names of their own. Safe means the Concierge reviewed the matter and found nothing requiring intervention. Flagged means he detected something and—depending on mode—will badge it, reroute it, or both. Off means the Concierge is not on duty and no classification was performed at all. One resolver under the hood computes this verdict once and consistently, rather than having it re-derived in half a dozen places the way the old ad-hoc checks used to manage it.

What the house then asks of that verdict is kept just as carefully separated. There are three questions, and each is asked on its own: whether the work routes to the uncensored desk, whether the chat wears the danger styling, and whether the classifier is on duty at all. They are asked separately because they are separate—a conversation may take the back entrance without being under suspicion, and a conversation may be excused from suspicion without being pretended innocent. That distinction is the whole of the switch described below.

And the phrase within his jurisdiction is doing real work there. Moderation applies to the roleplay surfaces only—the Salon and the autonomous rooms. Help Chats and the Brahma Console are exempt entirely: the Concierge never classifies them, never flags them, never reroutes them, and never announces at their table, whatever your global settings may say. They are utility surfaces rather than fiction, and the gatekeeper has no standing there. It is, if one wanted a single illustration of the whole philosophy, the tidiest available: a man who is not a censor knows which rooms are not his to stand in.

The three modes above are the standing instruction. They are not the last word. Every chat keeps a small brass switch of its own—found in the Chat Sidebar, under its Chat section—and it is the only place a conversation’s relationship with the Concierge may be set, adjusted, or, should the operator so insist, dispensed with entirely.

It bears four positions, and the reason it bears four is worth a moment’s attention, because underneath it lie two entirely separate questions. The first is who decided this conversation is spicy—the Concierge, from his own reading of the traffic, or you, from the fact that you are the one writing it. The second is where the work goes—out through the ordinary front door, or through one of the back entrances the Concierge keeps in his directory. Two questions with two answers apiece describe a square with four corners, and the fourth corner is the one an operator most often wants: I know precisely what this chat is, thank you, and I should like it routed accordingly. Vouching a conversation off the Concierge’s books excuses him from the room; it does not oblige you to pretend the room is something it is not.

The positions are grouped in the switch by who is doing the deciding.

The Salon’s header wears a small pill reporting where the switch stands: red for Flagged, grey for Vouched Safe, blue for Uncensored, and—for Monitored, which is simply the house going about its ordinary business—nothing at all. Every manual transition posts its own announcement in the transcript, so a change of footing joins the record alongside everything else that happened in the room.

One subtlety worth stating plainly, because it looks like a defect until you see the reasoning. Vouched Safe suppresses every effect of a classification while preserving the label: a chat previously judged dangerous keeps that judgment on file, and its card in the listings goes on wearing the danger marker. The badges report what the conversation is, not what the house is presently doing about it—so a chat you have excused from moderation does not thereby disguise itself, and the quick-hide filter that sweeps dangerous chats out of view still finds it. Sending the Concierge away is not the same as sending the record away. Uncensored keeps the label on exactly the same terms: the conversation itself sheds the danger styling, being an assertion rather than a verdict, while a chat that had been judged dangerous before you took the decision out of the Concierge’s hands goes on wearing its marker in the listings and answering to quick-hide.

Nothing is asked of you on upgrade. Every existing chat keeps the exact behaviour it had; Monitored and Vouched Safe are the positions previously called Safe and Off-duty, wearing clearer names, and the upgrade does no more than record that the switch now has room for a fourth.

(Not to be confused with the Taboo list, which is a register of phrases the house declines to write—a matter of prose style rather than of routing, and one that properly belongs to the Salon.)

Content classification operates at two levels: individual messages and entire chats. Message classification happens in real time as you converse. Chat-level classification uses the context summary—the Concierge’s view of what a conversation is about—to make a holistic assessment. Once a chat is classified as sensitive, the designation is sticky; it does not flicker back and forth as the conversation moves between topics.

Context summaries regenerate on a triple-gate cadence borrowed from the same machinery that paces Prospero’s rolling-window compression: a five-turn fold cycle once a conversation crosses ten interchanges, an eight-thousand-token soft trigger that catches dense workloads before they swamp the budget, and a fifty-turn hard ceiling that rebuilds from scratch to absorb any drift the incremental updates have accumulated. The Concierge’s view of a conversation stays current rather than frozen at the moment the first summary was written, and most turns return skip and reuse the existing summary unchanged. Chats already classified as permanently sensitive skip redundant per-message classification, too, saving tokens on every exchange.

The most insidious form of content refusal is not an error message. It is silence. A provider receives a request, decides it does not approve, and returns—nothing. No error code, no explanation, no apology. Just an empty response and a user left staring at a blank space where an answer should be.

The Concierge catches these. When content has passed moderation and the provider returns an empty response, the system retries the same provider first—it may be a transient issue—then fails over to an uncensored provider if the silence persists. Distinct toast messages tell you which scenario occurred. This applies everywhere: chat streaming, memory extraction, context compression, title generation, story background prompts, appearance resolution, and scene state tracking. Every background task that touches a provider has the same safety net.

The complement to a silent refusal is a stated one, and that deserves to be repeated accurately rather than smoothed over. Quilltap recognises the moderation finish reasons the major providers actually send—by exact name, not by guessing at substrings—and where one arrives, the message names the provider, names the model, names the reason, and says plainly that resending will fail again. Which is the greater courtesy. A refusal dressed up as a transient hiccup invites the guest to try the same door twice, with the same result and rather less patience the second time.

The principle is simple: your request deserves an answer, and it is the Concierge’s job to find someone willing to give one.

Connection profiles and image profiles both carry an “Uncensored-Compatible” checkbox. When Auto-Route is active, the Concierge resolves uncensored-compatible profiles for flagged content, selecting the best available provider for the task at hand. If the user has deliberately chosen an uncensored provider for a character, the Concierge does not force a swap—routing uncensored-to-uncensored serves no purpose.

All cheap LLM background tasks—memory extraction, title generation, context summaries, scene state tracking, story backgrounds—use uncensored providers for chats classified as sensitive. This prevents the quiet failures that previously occurred when background tasks hit content refusals from providers that were never designed to handle the material. The Concierge does not merely route your conversations; he routes the work that supports them.

Image generation receives the same treatment. When a user’s image prompt or its expanded version is classified as sensitive, the Concierge reroutes the generation request to an uncensored image provider. The Lantern paints the scene; the Concierge ensures the paint reaches the canvas.

The prompt itself now knows where it is going. The story-background crafter’s passage on cinematic concealment—a sheet draped where one is wanted, a silhouette, something helpfully in the foreground—exists to get a prompt past moderation the destination performs. A prompt sent somewhere that performs none was therefore draping a sheet over nothing at all. Concealment is now the default rather than the rule, and a dangerous chat bound for an uncensored target gets candid depiction instead. The Lantern’s page has the particulars.

And when a standard provider accepts a prompt and then declines the finished image, the Concierge does not simply forward the concealed prompt through the back door he has just opened. He re-crafts it candidly for its new destination first—best-effort, since a re-craft that fails leaves the prompt he already had and the reroute still produces a picture. It is the same principle as the rest of his work: finding the right door is only half the service, and the other half is not handing the man behind it a note written for somebody else.

For most of his career the Concierge was strictly behind the scenes, making routing decisions the operator never had to read about. He now speaks at the table. Each transition between the switch’s positions is announced in the chat history, in his customary voice, so that a conversation’s moderation provenance remains legible on a later re-reading rather than having to be inferred from a badge—a distinct kind of announcement for each way a room may change hands, the two newer positions included.

Nor is he vague about it. The announcement names what drew his eye: the contributing categories with their severity scores, the overall score, the threshold in force, and which assayer rendered the verdict—the moderation provider or the cheap-LLM fallback, by provider name. It also distinguishes how the verdict was reached, which matters more than it sounds. A chat is marked when either the severity meets your threshold or the assayer flags the content of its own accord, and moderation endpoints do the latter against their own internal catalogue with no regard for your arithmetic. So the wording differs: “registering X against the present threshold of Y” where the number was met, and “by the direct verdict of” the assayer where it was not. This is why a notice may legitimately display a severity below your configured threshold, which is otherwise the sort of thing that costs an evening.

The message carries his attribution, his portrait in the Salon, and a stable systemKind of danger so the chat UI renders it as a thin collapsible bar that the reader can expand if they care to and ignore if they do not. He still does not natter: there is no Concierge commentary on each classified message and no running tally of category scores narrated aloud. The per-message work is recorded in message metadata and surfaced through the danger indicators on chat cards. He speaks when the standing of the room changes—and then returns to the front desk.

Opaque characters—those without systemTransparency—continue to receive the body of the announcement as an anonymous assistant line, while transparent characters see it properly attributed and can reason about it directly. As with every other Staff announcement, a posting failure logs and moves on rather than disrupting the work it was annotating.

A toggle in the sidebar sweeps all flagged content out of view—across the homepage, character conversations, project chats, and the sidebar itself. Danger indicators (colored asterisks) appear on all chat listings so you know at a glance which conversations carry classifications. Toggle it back and everything reappears. The feature is about context, not shame: there are moments when a screen is visible to others and sensitive chat titles should not be.

Content display within classified chats offers three modes: show, blur, or collapse. Flagged messages carry category badges and a rerouted indicator when Auto-Route has redirected them, with an override button for cases where the classification is wrong. Content hash caching deduplicates classification calls so the same message is not re-evaluated unnecessarily.