Iris can give you advice all day. But the interesting part is when it stops talking and does the thing. This post is about how Iris can ai take action with confirmation — creating, updating, and deleting real resources on your account without you ever losing control. The short version: reads are free and unrestricted, but every write goes through a confirmation gate with a field-level diff, and the changes most likely to break something get replayed against your real traffic before you approve them. Operator-grade capability, driver's-seat safety.
Advice is cheap; doing the thing is the point
Iris runs inside the gateway, so it knows both the platform and your account. In an authenticated chat it reads your account-scoped data using your own forwarded token — endpoints, traffic, usage and billing, certificates, policies, members. Reads are always allowed and always read-only, so you can ask "which endpoints have no rate limit?" or "show me last night's 5xx spike" and get a real answer off real data.
The step past that is action. Ask Iris to add a rate-limit rule, tighten a firewall policy, or update a traffic-policy rule and it doesn't just print YAML for you to paste — it prepares the actual write against the real API. That's the difference between a chatbot and something that operates the gateway. But "it can write" is exactly the sentence that should make you nervous, which is why none of it happens on a hidden path.
Every write is a confirmation card
There is no such thing as a silent config change. Every create, update, or delete Iris wants to make surfaces as a confirmation card with a field-level, before-to-after diff. You see exactly which fields change, what they were, and what they'd become. Nothing is applied until you click.
# Iris proposes; you approve. A rate-limit update shows as:
UPDATE rate_limit "api-burst"
requests_per_second: 100 -> 50
burst: 200 -> 100
window: 1s (unchanged)The diff is the contract. If a field isn't in the diff, it isn't being touched. This also means you review Iris's intent, not its prose — the card is generated from the real request payload, so what you approve is what runs.
Blast-radius preview
A diff tells you what changes. It doesn't tell you what breaks. So for the three write types where a wrong move is expensive — firewall, rate-limit, and traffic-policy — the confirmation card also carries a blast-radius dry-run. Before you approve, Iris replays the proposed change against your real recent traffic and shows you what would have happened.
Tighten a firewall rule and the preview tells you how many of your last requests it would have blocked, and which ones. Drop a rate limit and you see how many real clients would have been throttled. This is the same idea behind generating firewall rules with AI: the value isn't the rule, it's knowing what the rule does to your traffic before it's live. A rule that looks reasonable and would have blocked 40% of legitimate requests is a rule you catch here, not in an incident channel.
Guardrails
Two more layers sit underneath the confirmation gate. The first is a batch-approve homogeneity guard. When Iris proposes several writes at once, approving them together only works if they share the same method and path prefix — so you can bulk-approve five rate-limit creates, but a DELETE smuggled into a batch of POSTs can't ride along on one click. Homogeneous batches only.
The second is a set of things that are hard-denied forever, independent of anything you or a prompt could ask:
- Admin and internal APIs — Iris operates as you, never as an operator of the platform.
- Deleting, leaving, or transferring the account.
- Widening Iris's own autonomy — it cannot grant itself more permission than you've given it.
Those denials are prompt-independent. There is no clever phrasing that unlocks them, because they aren't enforced by the model — they're enforced by the gate around it.
By default every write needs a click. There is one narrow exception, and it's opt-in: on the top tier you can enable unattended autonomy, and only for firewall POST/DELETE. Even then a change applies without a click only after a passing dry-run, and it auto-reverts if it hurts real traffic. Everything else — every other resource, every other verb — always waits for you. And whatever path a change took, the AI-activity ledger records it: "what has Iris done on my account?" lists every AI tool call, so nothing is invisible after the fact.
If you want to see the gate in action, point Iris at your own gateway. Spin up an endpoint and ask it to tighten something:
# Free plan: 5 endpoints, no credit card.
brew install ngris
ngris http 3000 --url app.ngris.comThen open the chat and ask Iris to add a rate limit or a firewall rule. You'll get a confirmation card, a diff, and — for firewall and rate-limit writes — a blast-radius preview against your real traffic before a single thing changes. Advice is cheap; this is Iris actually doing the work, with you still holding the button.