Operator Control

AI Preview operator control

Enable (operator) #

1. Keep ai.enabled: false until a local compatible server is ready.
2. Set ai.provider: openai_compatible, ai.base_url, ai.model.
3. Leave require_human_approval: true, redaction on, training_export.enabled: false.
4. Place credentials via local envelope custody — not YAML, not the browser.
5. Restart Manager.
6. GET /api/v1/ai/status — enabled, configured, recommendation_only, offline_mode, manager_readiness_depends_on_ai (false), last error fields.

Use (advisory) #

• POST /api/v1/ai/security-logs/:id/explain
• POST /api/v1/ai/incidents/analyze with log_ids
• Manual analysis preview → execute with confirmation token and acknowledgements
• List / approve / reject recommendations (reason field)

Approve/reject is governance only. There is no apply-rule AI route. Drafts stay unpublished until a human uses the ordinary rules API.

Disable #

Set ai.enabled: false and restart. Provider objects may remain; they do not run. Destroy custody material with confirm_destroy when retiring a binding.

Do not #

• Enable internal AI development endpoints as Preview
• Send Hosting raw collector payloads
• Treat token usage fields as a billing product

Related #

• API
• Provider keys stay Manager-side. Custody details are provided separately to Enterprise customers.