Network Operations and MonitoringOperator runbook

Safety & Risk Levels

How iPilot plans and approves changes — risk levels, Autopilot, and safety guarantees.

Get help
What this guide covers

How iPilot plans and approves changes — risk levels, Autopilot, and safety guarantees.

On this page

Operator stays in control

iPilot never executes a command without your approval — either a click, or an explicit Autopilot setting you control. Nothing runs silently.


How Plans Work

When you send a message, iPilot replies with one of:

  1. A clarifying question — if your goal is ambiguous.
  2. An execution plan — a numbered list of commands, each with:
    • The exact command to run
    • A one-line explanation of why
    • A risk badge: safe · caution · destructive

You can:

  • Run steps one at a time (click Run on each step)
  • Run all safe steps at once
  • Accept the plan and let it build on Autopilot — safe and caution steps auto-run, while destructive steps still pause for approval

After each step runs, iPilot reads the output and refines the next step automatically.


Risk Levels

Risk Meaning Examples
🟢 safe Read-only, no state changes show, print, display, get, monitor-traffic
🟡 caution Changes config but easily reverted /interface set, /ip address add, /queue simple add
🔴 destructive Wipes, reboots, or deletes critical config system reset, erase startup-config, format flash, halt

Destructive commands always pause

A server-side denylist automatically re-classifies dangerous patterns as destructive and marks them blocked — even if the AI under-reports the risk. Blocked steps require an explicit CONFIRM before they run.


Autopilot

The Autopilot toggle controls how much automation you allow:

Setting Behavior
Off (default) Every step needs an explicit click
On safe and caution steps auto-run; destructive steps always pause for a click

When Autopilot is on, the toggle in the panel header lights up as an active indicator.


Context & Memory

iPilot maintains a rolling conversation history and manages the context window for you — there is no manual compaction step to run:

  • Older messages are automatically trimmed to fit the model’s token budget.
  • Use /clear to start a fresh conversation.
  • Use /history to show your saved session summary.

The system always retains at least the last 20 messages (configurable), so recent context is never lost when older history is trimmed to fit the token budget.


Safety Guarantees

  • Server-side denylist — hard-blocked patterns include system reset, reboot, reload, erase startup-config, format flash, halt, shutdown, rm -rf /, dd if=, and RouterOS equivalents (/file remove, /user remove admin, /system package uninstall). These never auto-run, even on Autopilot.
  • Rate limits — up to 5 tool iterations per request, 20 requests per minute per user, and generated plans are capped at 12 steps.
  • Full audit trail — every request is logged with the operator (id, name, role, IP), the target device and vendor, and the plan steps with their risk levels.
  • Outbound request guard — the web fetch tool blocks requests to private or internal network addresses and refuses redirects to them.

Need help applying this guide?Browse related guidance or ask the support team for help.