Skip to main content
The Configuration assistant is a chat panel on the Configuration tab. Ask it what a setting is, or tell it what to change, and it reads the same settings the sub-tabs show and proposes the change for you to confirm.

​
What it is

A narrow Ask rail sits at the right edge of the Configuration tab. Click it, or press Cmd+\, to open a panel titled Configuration assistant. Press Cmd+\ again, or use the collapse arrow, to close it. The panel stays open while you move between sub-tabs, and it knows which sub-tab you are looking at, so “what is set here?” means the sub-tab in front of you. The conversation is kept when you leave Configuration and come back; the + button in the header starts a new one. An empty panel offers four starting points:

​
What it can read and change

It covers the same ground as the sub-tabs, one row per sub-tab: So you can ask the audit log a question in plain language (“what changed yesterday?”, “who rotated a key this week?”) and get an answer from the entries themselves, and you can run Doctor from the chat and get a summary of what needs attention.

​
Every change is confirmed

The assistant proposes one change at a time. Each proposal appears in the panel as a card with a short summary of what will happen and two buttons, Confirm and Cancel.
  • Nothing is written until you click Confirm.
  • Cancel does nothing, and the assistant says the change was cancelled.
  • A confirmation works once. It also expires after ten minutes, so an old card left in the conversation cannot be confirmed later; ask again for a fresh one.
Before it proposes removing a user, an API key, a secret or a repository token, the assistant reads the current list and names the exact one it will remove. If your request could mean more than one, it asks which. Changes you confirm here are carried out as your own actions. The Agent Policy gates agents and API-key clients, not the Configuration assistant, so a confirmed change is not queued for approval: your Confirm is the approval.

​
Secrets never go in the chat

For AI provider credentials, code repository access tokens and secret values, the panel opens a masked form on the card. The value goes from your browser straight to the platform; the assistant only learns that it was provided. The assistant will not ask you to paste a key, token or password into the conversation. If an answer shows a value as ••••••••, the value is set, not missing: masked values are never revealed.

​
Shown once

Two kinds of value are shown once, on the card, with a Copy button:
  • the temporary password for a new user;
  • the value of a newly issued or rotated API key.
They appear on that card and nowhere else, and the assistant does not repeat them in later answers. Copy the value before you move on. Resetting a password does not produce a value; the user sets a new one at next login, as described in User Authentication.

​
Who can use it

  • With user authentication on, the panel is shown to admins only.
  • With user authentication off, it is shown to everyone who can open Configuration.
  • On a trial install it is not shown.
With user authentication on, the assistant needs a signed-in admin session. A client that authenticates with an API key, including the CLI and MCP agents, cannot use it, and the MCP tool catalog does not gain any of these abilities: agents still see Platform-tab secrets as read-only (see the Assistant) and still need a scoped key for everything else (see API Keys).

​
Audited as you

With user authentication on and the audit log on, every change the assistant makes lands in the audit log (best effort by default; see strict mode) attributed to the signed-in admin, exactly as if you had made it in the sub-tab, with via: config-chat in the entry detail so you can tell which changes came through the panel. With user authentication off there is no signed-in user, and the entry is recorded like any other UI action.

​
Refresh and Show me

When a change succeeds, the sub-tab that owns the setting reloads on its own, so what you see matches what was saved. A Show me link on the card switches to that sub-tab. Links that open Configuration on a given sub-tab now work for Code Repository too (?tab=code-repo).

​
What it leaves to other panels

The Configuration assistant handles settings. Other questions go elsewhere, and it will say which panel to use:
  • building taps and pipelines, including Live Read, belongs to the Assistant;
  • runs, failures, retries and recovery belong to the Ops panel (see Incidents);
  • questions about the data itself belong to the Search panel.
The settings those rely on (AI providers, secrets, the code repository, users, API keys and agent policy) are the Configuration assistant’s.