Server-Level AI Access Controls
Who this is for
Organization Owners and Admins who want to restrict AI Pilot's access to specific servers, for example, to prevent the AI from touching production servers entirely, or to allow only read access on sensitive servers.
What you will complete
Set per-server AI access levels: Full Access, Read Only, or No Access.
Before you begin
- Owner or Admin role required.
- At least one server must be connected to your organization.
- Go to Settings → AI Agent → Per-Server Access.
Overview
By default, AI Pilot has full access to all servers in your organization, meaning it can read metrics, view logs, and (with Write Actions enabled) propose write operations.
Per-Server Access lets you override this default on a server-by-server basis without disabling AI Pilot globally.
Three access levels:
| Level | What the AI can do on this server |
|---|---|
| Full Access | Read metrics, view logs, propose and execute write actions (subject to approval) |
| Read Only | Read metrics, view logs, cannot propose any write actions |
| No Access | The AI cannot interact with this server in any way |
Step-by-step: set per-server access
- Go to Settings → AI Agent.
- Scroll down to the Per-Server Access section.
- You will see a list of all servers in your organization.
- For each server, use the dropdown on the right to select:
- Full Access: the AI can propose and execute all permitted write operations (subject to Agent Controls settings and your approval)
- Read Only: the AI can observe and analyze but cannot propose changes
- No Access: the AI cannot reference or interact with this server at all
- The setting saves immediately when you select a new value. No save button needed.
- Verify by asking AI Pilot about the server. A No Access server will not appear in the AI's responses.
Recommended access patterns
Sensitive production servers: Set to Read Only. This lets the AI analyze and alert you to issues without being able to propose changes, even if the global Write Actions toggle is on.
Archived or legacy servers: Set to No Access to exclude them from the AI's context entirely. This reduces noise and prevents the AI from accidentally including them in operations.
Development and staging servers: Leave on Full Access. These are safe for the AI to operate on freely.
Servers managed by another team: Set to Read Only so the AI can still monitor them but cannot propose changes that would affect another team's work.
What success looks like
- Selecting a new access level shows a "Server access updated" confirmation toast.
- When you set a server to No Access and then ask AI Pilot about it by name, the AI responds that it does not have access to that server.
- When you set a server to Read Only and ask the AI to restart a service on it, the AI responds that it cannot propose write operations for this server.
Common errors and fixes
"The Per-Server Access section is not visible" Cause: No servers are connected to your organization yet. Fix: Connect at least one server. Go to Servers → Provision Server or Servers → Import Server.
"I set a server to No Access but the AI still mentions it" Cause: The setting may be cached in the current AI conversation. Fix: Start a new conversation in AI Pilot. The new access setting takes full effect from the next request.
"I set a server to Read Only but the AI still proposed a write action for it" Cause: A prior conversation session may have cached the old access level. Fix: Start a new conversation. If the issue persists, check that the dropdown still shows Read Only, it should save immediately.
"I cannot find a specific server in the Per-Server Access list" Cause: The server may be in a disconnected or archived state. Fix: Only active, connected servers appear in the list. Reactivate the server to manage its AI access level.
Safety notes
- Per-Server Access controls are in addition to (not a replacement for) Production Protection. Both can be active at the same time.
- Setting a server to No Access does not prevent other organization members from manually managing it, it only affects AI Pilot.
- Changes to per-server access take effect immediately for new AI conversations.