Autonomy Account

AI Autonomy

Per-account, per-action-class settings that control whether the Iris AI assistant may apply a change unattended or must always ask you first. Autonomy only ever applies to safe, reversible action classes; every other change is confirm-gated regardless of these settings.

Two independent opt-ins are required before anything runs unattended: your plan must include the ai_autonomy entitlement, and an account owner must set a class to auto or canary here (the default for every class is confirm). Even then, an action is applied automatically only when a live traffic dry-run predicts it is safe — and it is monitored afterward and rolled back automatically if it hurts real traffic.

Human-only: these settings can only be changed by a signed-in account owner/admin. Iris itself can never modify them.

Modes

off

Iris never acts on this class (not even to ask).

confirm

Default. Iris drafts the change and shows a confirmation card with the blast-radius preview; you approve.

canary

Probationary auto: the first change applies unattended and must verify healthy before further same-class changes auto-apply.

auto

Unattended apply for safe, dry-run-clean changes; verified and auto-rolled-back on regression.

Configurable action classes

Only these reversible classes can be set to canary/auto: attack_ip_block, false_positive_relax, rate_limit_tune, firewall_rule_edit, traffic_policy_edit. All other classes always confirm.

Get Autonomy Settings

GET /v1/account/autonomy

Returns the active account's setting for each configurable class (unset classes read back as confirm) plus whether the plan is entitled to autonomy.

Response (200 OK)

entitled bool

Whether the account's plan includes the ai_autonomy entitlement. When false, unattended modes are refused.

classes array

One entry per configurable class: action_class, mode, canary_percent, canary_dwell_minutes.

Update an Autonomy Setting

PUT /v1/account/autonomy

Upserts the mode for one action class. Requires an active account.

Request body

action_class string Req

One of the configurable classes above. Others are rejected with 400.

mode string Req

off | confirm | canary | auto. canary/auto require the ai_autonomy entitlement.

canary_percent int

Optional. 0–100. Reserved for canary rollout sizing.

canary_dwell_minutes int

Optional. Probation window for canary mode. Defaults to 60.

Response (200 OK)

Echoes the stored setting (same shape as one classes entry).

Errors

400 Bad Request

Invalid body, unconfigurable action_class, invalid mode, or no active account.

401 Unauthorized

Missing auth.

403 Forbidden

Your role lacks write on the account settings resource, or an unattended mode was requested without the ai_autonomy entitlement.

Request — get
curl -X GET "https://api.ngris.com/v1/account/autonomy" \
  -H "X-API-KEY: <your_api_key>"

Response — get (200 OK)
{
  "entitled": true,
  "classes": [
    { "action_class": "attack_ip_block",      "mode": "auto",    "canary_percent": 0, "canary_dwell_minutes": 60 },
    { "action_class": "false_positive_relax", "mode": "confirm", "canary_percent": 0, "canary_dwell_minutes": 60 },
    { "action_class": "rate_limit_tune",      "mode": "confirm", "canary_percent": 0, "canary_dwell_minutes": 60 },
    { "action_class": "firewall_rule_edit",   "mode": "confirm", "canary_percent": 0, "canary_dwell_minutes": 60 },
    { "action_class": "traffic_policy_edit",  "mode": "confirm", "canary_percent": 0, "canary_dwell_minutes": 60 }
  ]
}

Request — set a class to auto
curl -X PUT "https://api.ngris.com/v1/account/autonomy" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "action_class": "attack_ip_block",
    "mode": "auto"
  }'

Response — update (200 OK)
{
  "action_class": "attack_ip_block",
  "mode": "auto",
  "canary_percent": 0,
  "canary_dwell_minutes": 60
}

PreviousAI Objectives NextList Members

On this page

AI Autonomy