Most "AI in a product" is a documentation bot with a chat skin. It has read the manual, so it can tell you what a rate-limit rule is — but it has never seen your rate-limit rules, your endpoints, or how close you are to your plan ceiling. Iris is a different thing. Iris is an ai account assistant: it runs inside the gateway, and in an authenticated chat it reads your own account — your endpoints, traffic, usage, certificates, policies, and members — using your forwarded token, read-only. You ask questions about the account you actually operate, and it answers from live data instead of from prose. This post is about that reading half. Writes are a separate, gated story; here we stay on what Iris can see. For the broader picture, start with the Iris hub.
A doc bot can't see your data; an ai account assistant can
The gap is architectural, not cosmetic. A doc bot answers from a fixed corpus — it cannot know that you have 14 endpoints, that one of them lost its WAF binding last Tuesday, or that a wildcard cert expires in nine days. Iris can, because it lives in the same gateway that serves your traffic and holds your config. When you chat while signed in, Iris makes account-scoped GET calls with the token from your session. It sees exactly what your token is allowed to see and nothing more, and every one of those calls is a read. It does not mutate anything to answer a question.
Concretely, that means Iris can pull your endpoint list, per-endpoint traffic, usage and billing figures, certificate inventory, attached firewall/rate-limit/traffic policies, and account members — then reason over them in one place. It is the difference between "here is how certificates work" and "here are your certificates, sorted by expiry."
The kind of questions you can actually ask
Because the reads are live and account-scoped, the useful questions are the specific ones you'd otherwise answer by clicking through five dashboard pages:
- "Which endpoints don't have the WAF attached?" — Iris cross-references your endpoint list against attached traffic policies and names the gaps.
- "How close am I to my plan limit?" — it reads your current usage against your plan's ceiling and tells you the headroom, not a generic quota table.
- "Which certs renew this month?" — it filters your certificate inventory by expiry window instead of making you scan a list.
- "Which endpoints took the most 4xx in the last day?" — it reads real per-endpoint traffic and ranks them.
- "Who are the members on this account, and what can they do?" — it reads your member and role data directly.
These are read-only diagnosis flows. There's also a one-command account report: a structured markdown summary built entirely from real reads and exportable, so you can hand it to a teammate. It never fabricates data — if a number isn't in your account, it isn't in the report. And natural-language log search compiles an English question into a real traffic filter, so "show me blocked POSTs to /api from outside the EU last hour" becomes an actual query over your logs, not a guess.
Your credential, read-only, with an activity ledger
The token Iris uses is your credential, forwarded from your session — not a shared service account with god-mode. That has two consequences worth being explicit about. First, Iris can never see more than you can; the account boundary is enforced by the same token that gates your dashboard. Second, reads are always allowed and always read-only. Answering "which certs renew this month?" changes nothing.
To make that auditable rather than a promise, there's an AI-activity ledger. Ask "what has the AI done on my account?" and Iris lists every AI tool call it made — reads included. Nothing the assistant does is invisible. If you later use the gated write flows, those show up here too, so the ledger is the single place to answer "what did the AI touch, and when."
To be honest about scope: this post is about reads. Iris can create and change resources, but every write is a separate, gated action — a confirmation card with a field-level before-and-after diff you approve by clicking, and for firewall, rate-limit, and traffic-policy changes a blast-radius dry-run that replays the change against your real recent traffic first. Admin and internal APIs, deleting or transferring the account, and widening Iris's own autonomy are denied forever, prompt-independent. Nothing gets applied silently. If you want to see how the write side and its dry-run replay work, that's its own topic.
Guest vs authenticated
There are two modes, and the line between them is the token. In a guest chat — before you sign in — Iris knows the platform: how endpoints work, what a traffic policy does, how to attach a WAF. It cannot read your account, because there's no forwarded credential and no account to read. It's the knowledgeable-stranger mode.
In an authenticated chat, the same assistant gains your account-scoped reads. Same Iris, same knowledge of the platform, plus live sight of your specific endpoints, traffic, and policies. The upgrade isn't a different model or a paid tier — it's that you're signed in and the token is present. Sign out and the account reads go away; the platform knowledge stays.
Getting there costs nothing to try. The free plan gives you 5 endpoints with no credit card. Point a tunnel at a local service and start asking Iris about it:
# install and expose a local app in one command
brew install ngris
ngris http 3000
# or bind it to a hostname you own
ngris http 3000 --url app.ngris.comOnce you have an endpoint, open the authenticated chat and ask it something real — "which endpoints don't have the WAF attached?" — and watch it answer from your account instead of from a manual. When you're ready to have it draft rules too, generating a firewall policy with AI is the natural next step.