Iris (AI)
Iris — your AI assistant
Iris is the AI assistant built into your Ngris dashboard. Ask it in plain language to inspect, configure, and troubleshoot your endpoints — it works the dashboard on your behalf, using your own permissions, and asks for confirmation before it changes anything.
Unlike a generic chatbot, Iris is wired into the real Ngris API. When you ask it to “turn on rate limiting for my API endpoint,” it locates the endpoint, proposes the exact change, shows you a confirmation card, and only applies it after you approve. Every write it makes is recorded in an audit log you can review.
Opening Iris
There are two ways to chat with Iris, and they share the same conversation engine:
- The chat widget — the floating button in the bottom-right corner of every dashboard page. Click it to open a side panel without leaving the page you’re on. Iris knows which page you’re viewing, so “harden this endpoint” just works.
- The full chat page — a roomier, full-screen conversation at
/account/ai/chat, good for longer sessions, reports, and reviewing tables.
Some dashboard alerts and proactive nudges include a “Ask Iris” link that opens the widget pre-loaded with the relevant context (for example, the specific endpoint that just went down).
What Iris can do
Iris covers most day-to-day operations you’d otherwise do by clicking through the dashboard. A few examples:
| Area | Ask it to… |
|---|---|
| Endpoints | List your endpoints, check health, create or rename one, adjust traffic policy, walk you through going live. |
| Security & access | “Secure this endpoint,” choose an auth mode, set up mTLS, build firewall and rate-limit rules, explain why a request was blocked. |
| Exposure review | “Who can reach this endpoint?” — a plain-language exposure report across auth, firewall, and IP rules. |
| Bulk hardening | “Secure all my open endpoints” — Iris finds the ones with no authentication and applies a protective mode across them in one step. |
| Custom domains | Add a domain, check provisioning/DNS status, troubleshoot certificate issuance. |
| Troubleshooting | Diagnose a failing endpoint, split “platform vs. your origin” faults, tune policy from real traffic. |
| Team & accounts | Explain roles and permissions, invite members, review who can do what. |
| Billing & usage | Summarize current usage, explain your plan limits, surface overage or unpaid-invoice risk. |
| Reports & export | Compile a multi-section account report you can download as HTML or print to PDF, and export any table to CSV. |
If you ask for something Iris can’t do — or something your plan or role doesn’t permit — it tells you plainly rather than guessing. It won’t invent endpoints, IDs, or API calls.
Confirmation & audit
Iris can read your account freely, but it never makes a change silently. Before any write — creating, updating, enabling, or deleting — it shows a confirmation card describing the action in your own terms:
- a plain-language title (e.g. “Enable rate limiting on api-prod”),
- a preview of exactly what changes — an update shows the current value → the new value field by field; a create shows the values that will be set; a delete shows which resource is being removed,
- a blast-radius preview for firewall, rate-limit, and traffic-policy rules — Iris replays your recent real traffic through the proposed rule and shows how many requests it would newly block, throttle, or redirect, how many of those were previously succeeding, the top affected IPs/paths/countries, and a safe / risky verdict, and
- Approve / Cancel controls — nothing happens until you approve.
Every action Iris performs on your behalf is written to an audit log. Review the history of AI-initiated changes — what was done, when, and the outcome — any time on the AI activity page (Account → AI activity, at /account/ai-activity). This keeps the assistant accountable: there’s always a record you can audit.
Hands-off autonomy (opt-in)
By default Iris asks before every change. When you’re ready, you can let it handle the safe, reversible work on its own — enabled one action type at a time under Account → settings, never all-or-nothing. For each type (block a confirmed attacker, relax a proven false positive, tune a rate limit…) you choose:
- Ask first — the default; a confirmation card every time.
- Canary — the first change of that type applies on its own and must verify healthy before further ones auto-apply.
- Automatic — applies unattended, but only when the traffic dry-run says it’s safe.
Two independent opt-ins are always required: your plan must include the autonomy entitlement and an account owner must switch a type on — and even then, anything risky (or anything Iris can’t fully simulate) still comes to you. Every automatic change is verified against real traffic and reverted on regression; if a type produces too many reverts in an hour it switches itself back to ask-first. Autonomy settings are human-only — Iris can never change its own permissions.
Objectives — declare a goal, Iris keeps it true
Declare an objective for your account or a specific endpoint and it’s continuously reconciled — for example “keep p95 latency under 300 ms”, “keep the error rate under 1%”, “certificates never within 7 days of expiry”, or “stay under 80% of my data cap”. When an objective is missed, Iris raises a card that pre-loads the assistant to diagnose the cause (origin vs. edge) and walk you through the fix; where a safe automatic remedy exists and you’ve enabled autonomy for it, it can apply the fix for you. Recovered objectives clear themselves. Latency, error-rate and usage objectives are diagnose-only (the fix is on your side), so they never auto-change anything.
Manage objectives under the account’s observability area, or ask Iris to set one for you.
Reports & data export
Ask Iris for an account report and it compiles a structured document — a header, a short summary, and per-area sections (endpoints, security, usage, billing) as clean tables. You can then take it with you:
- Download as HTML — the report is saved as a self-contained, nicely formatted page.
- Print / Save as PDF — opens your browser’s print dialog with a clean, light-themed layout, so you can save a PDF.
- Download CSV — every table Iris shows has a button to export just that table as a spreadsheet-ready CSV.
These exports are generated in your browser from what’s on screen — nothing is uploaded anywhere to produce them.
Proactive nudges
Beyond answering questions, Iris watches your account in the background and surfaces nudges on your dashboard when something deserves attention — for example:
- a TLS certificate or custom-domain registration nearing expiry,
- usage burning toward (or past) a plan limit, or an unpaid invoice,
- an endpoint that just went down, a spike in blocked or suspicious traffic, or unusually slow responses.
Each nudge links straight into Iris pre-loaded with the issue, so you can review and resolve it in a couple of clicks. Prefer fewer interruptions? You can opt out of proactive nudges in your account settings.
Permissions, privacy & limits
- Runs as you. Iris acts under your authenticated session and role. It can never exceed your own permissions, and team members only see and change what their role allows.
- Hard server-side limits. Beyond your role, the platform enforces what the assistant may attempt at all: it can’t touch admin areas, and irreversible account-level actions (deleting the account, transferring ownership) are deliberately left to you to do by hand — these are blocked on the server, not just discouraged in the prompt.
- Confirmation before writes. Reads are free; every change is gated behind an explicit confirmation card with a preview (see above).
- Rate-bounded. The number of changes Iris can make per hour is capped per plan, so an unexpected loop can never run away.
- Audited. AI-initiated changes are recorded on your account’s AI activity page.
- Plan-aware. Iris respects your plan’s entitlements and limits — if a feature isn’t available on your plan, it says so instead of attempting it.
For the full marketing overview of the assistant, see the AI features page.