Safety & Risk Levels
How iPilot plans and approves changes — risk levels, Autopilot, and safety guarantees.
How iPilot plans and approves changes — risk levels, Autopilot, and safety guarantees.
On this page
iPilot never executes a command without your approval — either a click, or an explicit Autopilot setting you control. Nothing runs silently.
How Plans Work
When you send a message, iPilot replies with one of:
- A clarifying question — if your goal is ambiguous.
- An execution plan — a numbered list of commands, each with:
- The exact command to run
- A one-line explanation of why
- A risk badge:
safe·caution·destructive
You can:
- Run steps one at a time (click Run on each step)
- Run all safe steps at once
- Accept the plan and let it build on Autopilot — safe and caution steps auto-run, while destructive steps still pause for approval
After each step runs, iPilot reads the output and refines the next step automatically.
Risk Levels
| Risk | Meaning | Examples |
|---|---|---|
🟢 safe |
Read-only, no state changes | show, print, display, get, monitor-traffic |
🟡 caution |
Changes config but easily reverted | /interface set, /ip address add, /queue simple add |
🔴 destructive |
Wipes, reboots, or deletes critical config | system reset, erase startup-config, format flash, halt |
A server-side denylist automatically re-classifies dangerous patterns as destructive and marks them blocked — even if the AI under-reports the risk. Blocked steps require an explicit CONFIRM before they run.
Autopilot
The Autopilot toggle controls how much automation you allow:
| Setting | Behavior |
|---|---|
| Off (default) | Every step needs an explicit click |
| On | safe and caution steps auto-run; destructive steps always pause for a click |
When Autopilot is on, the toggle in the panel header lights up as an active indicator.
Context & Memory
iPilot maintains a rolling conversation history and manages the context window for you — there is no manual compaction step to run:
- Older messages are automatically trimmed to fit the model’s token budget.
- Use
/clearto start a fresh conversation. - Use
/historyto show your saved session summary.
The system always retains at least the last 20 messages (configurable), so recent context is never lost when older history is trimmed to fit the token budget.
Safety Guarantees
- Server-side denylist — hard-blocked patterns include
system reset,reboot,reload,erase startup-config,format flash,halt,shutdown,rm -rf /,dd if=, and RouterOS equivalents (/file remove,/user remove admin,/system package uninstall). These never auto-run, even on Autopilot. - Rate limits — up to 5 tool iterations per request, 20 requests per minute per user, and generated plans are capped at 12 steps.
- Full audit trail — every request is logged with the operator (id, name, role, IP), the target device and vendor, and the plan steps with their risk levels.
- Outbound request guard — the web fetch tool blocks requests to private or internal network addresses and refuses redirects to them.