Is RCA turned on by default?
No. RCA ships off, and you turn it on for the org. The default classifiers check traces without a model call; RCA opens an isolated agentic session against a case, reading its evidence and your repo when one is connected. On a self-hosted install, its model calls run on your org’s own provider key.
Turning it on makes the investigation available, not automatic on every finding. A person starts it on a case, so a classifier firing alone does not start spending against that key.