AI Center governance, audit trail & privacy in rConfig V8
AI Center governance, audit trail, and data privacy in rConfig V8
Section titled “AI Center governance, audit trail, and data privacy in rConfig V8”Before your security team signs off on AI features, they’ll ask three questions: what leaves our network, who can use it, and what’s recorded. This page answers all three, so you can hand it to them as is.
The short version
Section titled “The short version”- Nothing is sent until a user clicks an AI button or an agent calls the MCP server.
- You choose where data goes. With Ollama or another local model, inference stays on your network.
- AI never changes your devices. Every capability reads; the only thing it can write is a draft policy definition, and only when a user clicks save.
- Every AI request is audited by user, capability, provider, model, and token count. Prompt and response text are never stored in the audit trail.
Access control
Section titled “Access control”| Control | What it governs |
|---|---|
AI_CENTER_ENABLED in .env |
Whether the AI Center exists at all on this server. Off by default. |
aicenter.view permission |
Seeing the AI Center, accepting the terms, using AI features, listing your own MCP tokens. Included in every role template. |
aicenter.mcptoken permission |
Creating and revoking your own MCP tokens, without AI settings rights. |
aicenter.update permission |
Adding, editing, activating, and deleting providers; toggling capabilities; managing customer knowledge; seeing, revoking and creating MCP tokens for users you manage. Admins have it. |
| Settings tabs | The AI Settings and AI Configuration tabs are shown only to users with aicenter.update. From V8.4.2 this follows the permission, not the role name. |
| Capability toggles | Each of the four capabilities can be switched off for everyone in AI Configuration. |
| Device access | AI features and MCP tools only see devices and configs the user’s role can see. See Roles. |
Terms acceptance
Section titled “Terms acceptance”From V8.3.3, each user must accept the AI Center terms before using any AI feature. The first time someone opens the AI Center, they see AI Center — Terms & Conditions, must open the terms on the rConfig portal, tick the agreement box, and click I Accept.
- Acceptance is per user and recorded with the time and IP address.
- Until a user accepts, the AI Center redirects them to the terms page and AI buttons elsewhere in rConfig are hidden for them.
- There’s no option to withdraw acceptance in the UI.
What data each capability sends
Section titled “What data each capability sends”The same information is on the Privacy tab in the AI Center.
| Capability | Data sent to your provider | Device config included? |
|---|---|---|
| Config Analysis & Explain | Your message; on the first message only, the device config (whole up to about 100,000 characters, trimmed by section above that) and config metadata. Follow-ups send only the new message. | Yes |
| Drift Detection & Narration | Device name, change trigger, severity, the diff (up to 8,000 characters, secrets obfuscated), and the first 40 lines of the current config. If no diff is stored, the full previous and current configs. | Partial |
| Policy & Compliance Narration (narration) | Device name, policy name, overall result, reason, and per-rule results. No config text. | No |
| Policy & Compliance Narration (rule generation) | Policy name and description, plus up to 8 KB of a config you choose to paste in, with credentials redacted. | Optional |
| Optimization Assistant | Your message and the conversation history. | No |
| MCP Server | Nothing is sent to your AI provider. The agent you connect receives tool results (device data and configs, with secrets obfuscated), within the token owner’s device access. | To the agent |
Every capability also sends a block of background knowledge from rConfig and any customer knowledge entries you’ve added.
Where your data goes
Section titled “Where your data goes”The Privacy tab classifies the active provider and tells you where data ends up:
| Classification | When | What it means |
|---|---|---|
| On-Premises | Ollama or OpenAI-Compatible with a base URL on localhost, a private IP range (10.x, 172.16-31.x, 192.168.x), or a .local or .internal host |
Config data doesn’t leave your network. |
| Cloud Provider | Anthropic, OpenAI, Google Gemini, or Azure OpenAI | Data is processed under that provider’s data-processing terms. |
| External API Endpoint | Ollama or OpenAI-Compatible with any other host | Data leaves your environment; check the endpoint operator’s terms. |
What rConfig doesn’t store
Section titled “What rConfig doesn’t store”- rConfig doesn’t host AI models. Requests go directly from your server to your provider.
- Narrations and one-off answers aren’t saved. Chat conversations are kept per user so you can return to them, and are only visible to that user.
- The audit trail stores metadata only, never prompt or response text.
Audit trail
Section titled “Audit trail”Every AI request records:
- user and IP address
- capability and conversation ID
- provider and model
- prompt and completion token counts
- timestamp
Prompt text, config content, and response text are never recorded. The audit trail is available through the AI Center API at GET /api/ai/audit-logs, filterable by capability, user, and date range, 50 entries per page. There’s no audit screen in the AI Center in this release.
MCP tool calls are recorded separately in rConfig’s activity log, with the tool name, whether it succeeded, and the device ID where there is one. Tool arguments aren’t stored.