AI rule assistance

AI assistance is an Enterprise preview in the shared anomaly rule editor. It creates proposals for review; rule changes still use the existing explicit save procedure. Real-provider interoperability and writing-quality improvements have not been measured by this implementation.

Configure a connection

1. As Core Admin, open Settings → AI connections with a valid Enterprise license and a loaded provider plugin.
2. Set an approved endpoint, model IDs, default model and transmission class. Choose an explicit text, json or native_schema mode. Rule results must be JSON and pass host validation; text mode carries the schema in the fixed server instruction without a mode fallback. local must identify an approved internal deployment; hosted/outside-boundary services use external. This declaration does not automatically verify network locality or retention.
3. Prefer HTTPS. Configure a trusted CA where needed; explicitly enable HTTP only for an approved internal endpoint. The address is reached from the plugin environment, so browser-local addresses may refer to another machine/container.
4. Enter a provider credential. It is stored encrypted and not returned. An empty edit field preserves the current secret; use the explicit clear operation to remove it.
5. Grant connection users/inherited groups or all resource managers, select allowed resources, and set timeout/concurrency/daily budgets. Resource viewers need explicit connection grants; all-resource-manager access means operators and Core Admins.
6. Save and run Check connection. All configured models undergo capabilities and metadata checks, without generating text or sending resource data. Editing any configuration revokes verification; failed checks clear prior approval.
7. Use Run sample generation only after explicitly accepting potential cost. It uses a fixed non-sensitive greeting, has no caller prompt/resource data and shares ordinary quotas. Missing usage means unknown; zero usage is distinct.

External resource context is denied by default. Explicitly allow external transmission for the selected resource before using an external connection. Core Admin does not bypass connection grants, transmission policy or budgets in ordinary rule assistance. The administrative fixed sample is a separate management operation and does not need a resource transmission policy.

Review a proposal

Select an eligible connection/model in the shared editor, describe the intended change, and read the resulting draft, questions, unsupported limitation or explanation. Check metric names, units, threshold values and timing. Review the structured difference and shared validation results. Apply a valid draft manually to the editor, then save through the ordinary rule workflow. Apply alone does not save, activate, evaluate, send a notification or execute a tool.

The lookup window takes the latest observation rather than calculating trends or aggregates. Hold duration is not a lookback. Missing/ambiguous intent should lead to questions; unsupported trends, formulas or actions must not silently turn into new threshold assumptions. Validation does not establish historical effectiveness.

The chosen connection revision also fences configuration changes before sending (such as a local-to-external change); refresh a stale selection. If a rule/editor revision, selection, permission, session/API key, account or license changes while waiting, the result is discarded. Cancellation does not guarantee zero provider cost. Daily UTC request/output ceilings are reserved before calls and retained conservatively on failure or unknown usage. Concurrent nodes share PostgreSQL limits and leases. Standby/unready nodes refuse billable calls without forwarding, replay, retry or cloud fallback.

Bodies are limited to 128 KiB; connection timeouts to 1–60 seconds. Rule requests have a 60-second overall ceiling, narrowed by configured/capability/SDK limits. Audit records retain identifiers, decisions and optional usage, not instructions, resource context, generated contents, credentials or endpoint details.

For policy, limits and API details, see the operating contract document (ai-rule-assistance.md).