OverviewRelease notesUpgrade guideInstallationGetting startedMicrosoft AD CSCisco Catalyst 9800Agents & automationNginx on LinuxHTTPS verificationAdministrationAPI credentialsCertificate profilesAI AssistantMCP integration

AI Assistant

Ask about the platform and prepare supported certificate actions with your existing permissions.

Dokumentacija za 1.0.38. Screenshotovi prikazuju ogledne podatke.

Dokumentacija je trenutno dostupna na engleskom. Sučelje proizvoda i ugrađena pomoć dostupni su na hrvatskom.

Planned for 1.0.38. The Assistant is optional and disabled by default. It uses an external provider configured by your administrator; provider usage is billed separately.

Configure the provider

  1. 01Sign in as an administrator under the normal MFA policy. Open Settings → Platform → AI Assistant.
  2. 02Select OpenAI or Anthropic and a tool-capable model available to your API project. Use a dedicated API key and provider spending limits. A consumer chat subscription does not supply this API entitlement.
  3. 03Enter the key in the configuration field. The platform encrypts it using the existing master-key vault; subsequent reads only indicate whether a key is set. Blank input preserves the key; changing provider clears the previous key.
  4. 04Review and accept the data-processing notice, then enable and save. Keep Allow reviewed issuance, renewal and deployment off for an initial read-only check.
  5. 05Test the saved configuration. This sends a billable synthetic request and checks connectivity; it does not validate model quality or device compatibility.

Use the chat panel

Open AI Assistant at the bottom right of a signed-in page. Expand or minimize it while navigating; the current conversation and draft remain available. Minimizing does not cancel a request or action already in progress.

  • ▸“Which certificates expire in the next 30 days?”
  • ▸“Explain the status of this deployment job.”
  • ▸“Help me prepare renewal of this certificate.”

The Assistant is scoped to ens0key operations and help. It reads only the data permitted by the current session, role and collection boundary.

Review before executing

When enabled by an administrator, the Assistant can prepare supported issuance using an existing profile, renewal of a platform-issued certificate, or deployment of an existing certificate to an existing destination. Review the proposed certificate, identity, profile and destination before explicitly confirming.

Existing authorization, policy and approval checks still apply. A prepared action is not an executed action; an accepted job is not proof that a certificate is installed or its service verified. Check the resulting job and service evidence.

Data handling and boundaries

Prompts and permitted certificate, CA, agent, profile and destination metadata may be sent to the selected provider. Provider retention, residency and account policies apply. Private keys and connector credentials are excluded from Assistant tools; do not paste secrets or sensitive free text into chat.

The Assistant does not provide arbitrary shell/SQL execution, web browsing or credential export. It does not autonomously renew or deploy certificates: each supported mutation requires separate review and confirmation.

External MCP access is a separate read-only integration identity. Configuring it does not enable this Assistant.

Validate in your environment

Verify the selected model, API access and read results against Inventory before using reviewed actions. Test only operations and destinations approved for your environment. Full provider/action acceptance remains configuration-specific.

ens0key 1.0.38-preview · Ogledni podaci