Server-Level AI Access Controls
Who this is for
Organization Owners and Admins who want to restrict AI Pilot's access to specific servers — for example, to prevent the AI from touching production servers entirely, or to allow only read access on sensitive servers.
What you will complete
Set per-server AI access levels: Full Access, Read Only, or No Access.
Before you begin
- Owner or Admin role required.
- At least one server must be connected to your organization.
- Go to Settings → AI Agent → Per-Server Access.
Overview
By default, AI Pilot has full access to all servers in your organization — meaning it can read metrics, view logs, and (with Write Actions enabled) propose write operations.
Per-Server Access lets you override this default on a server-by-server basis without disabling AI Pilot globally.
Three access levels:
| Level | What the AI can do on this server |
|---|---|
| Full Access | Read metrics, view logs, propose and execute write actions (subject to approval) |
| Read Only | Read metrics, view logs — cannot propose any write actions |
| No Access | The AI cannot interact with this server in any way |
Step-by-step: set per-server access
- Go to Settings → AI Agent.
- Scroll down to the Per-Server Access section.
- You will see a list of all servers in your organization.
- For each server, use the dropdown on the right to select:
- Full Access — the AI can propose and execute all permitted write operations (subject to Agent Controls settings and your approval)
- Read Only — the AI can observe and analyze but cannot propose changes
- No Access — the AI cannot reference or interact with this server at all
- The setting saves immediately when you select a new value. No save button needed.
- Verify by asking AI Pilot about the server. A No Access server will not appear in the AI's responses.
Recommended access patterns
Sensitive production servers: Set to Read Only. This lets the AI analyze and alert you to issues without being able to propose changes — even if the global Write Actions toggle is on.
Archived or legacy servers: Set to No Access to exclude them from the AI's context entirely. This reduces noise and prevents the AI from accidentally including them in operations.
Development and staging servers: Leave on Full Access. These are safe for the AI to operate on freely.
Servers managed by another team: Set to Read Only so the AI can still monitor them but cannot propose changes that would affect another team's work.
What success looks like
- Selecting a new access level shows a "Server access updated" confirmation toast.
- When you set a server to No Access and then ask AI Pilot about it by name, the AI responds that it does not have access to that server.
- When you set a server to Read Only and ask the AI to restart a service on it, the AI responds that it cannot propose write operations for this server.
Common errors and fixes
"The Per-Server Access section is not visible" Cause: No servers are connected to your organization yet. Fix: Connect at least one server. Go to Servers → Provision Server or Servers → Import Server.
"I set a server to No Access but the AI still mentions it" Cause: The setting may be cached in the current AI conversation. Fix: Start a new conversation in AI Pilot. The new access setting takes full effect from the next request.
"I set a server to Read Only but the AI still proposed a write action for it" Cause: A prior conversation session may have cached the old access level. Fix: Start a new conversation. If the issue persists, check that the dropdown still shows Read Only — it should save immediately.
"I cannot find a specific server in the Per-Server Access list" Cause: The server may be in a disconnected or archived state. Fix: Only active, connected servers appear in the list. Reactivate the server to manage its AI access level.
Safety notes
- Per-Server Access controls are in addition to (not a replacement for) Production Protection. Both can be active at the same time.
- Setting a server to No Access does not prevent other organization members from manually managing it — it only affects AI Pilot.
- Changes to per-server access take effect immediately for new AI conversations.