Security review of Iris: the questions to expect, and where the answers are
Security teams ask the same questions about any AI feature. This page lists them, gives the short answer for Iris, and points to the evidence. Use it to prepare for a review, or hand it to the reviewer.
Data handling
| Question | Short answer | Evidence |
|---|---|---|
| What data leaves rConfig? | Per feature: configs for analysis, diffs for drift, results only for compliance | Data flow map |
| Are secrets removed? | Yes, obfuscated before any AI path | Config obfuscation |
| Can data stay on site? | Yes, with a self-hosted model | Self-hosted design |
| Does rConfig store prompts or answers? | No; metadata only. Chats are kept per user | What rConfig doesn’t store |
| Does rConfig train or host a model? | No. rConfig calls the provider you configure | What is the AI Center? |
Access
| Question | Short answer | Evidence |
|---|---|---|
| Who can use it? | Users with aicenter.view who have accepted the terms |
Access control |
| Who can configure it? | Users with aicenter.update (admins) |
Same |
| Who can create MCP tokens? | Their own: users with aicenter.mcptoken. For others: admins, only for users they manage |
MCP Server |
| What can an agent see? | Only the token owner’s devices | Access and least privilege |
| Can a token be abused against the API? | No; MCP tokens are accepted only on /mcp |
Read-only by design |
| Can it be switched off entirely? | Yes; AI_CENTER_ENABLED is off by default |
Get started |
Integrity
| Question | Short answer | Evidence |
|---|---|---|
| Can AI change a device? | No AI path writes to devices or stored configs | Read-only by design |
| What can AI write? | A draft policy, saved only by a person | Drafting policies with AI |
| What about prompt injection? | Contained by read-only design; rules for multi-tool agents | Prompt injection and trust |
Logging and monitoring
| Question | Short answer | Evidence |
|---|---|---|
| Is AI use logged? | Every request: user, IP, feature, model, tokens, time | Audit trail |
| Are agent actions logged? | Every MCP tool call: tool, outcome, device | Application log |
| Is spend limited? | Not by rConfig; set limits at the provider | Cost and tokens |
Third parties
| Question | Short answer | Evidence |
|---|---|---|
| Which provider processes data? | The one you configure; the Privacy tab classifies it | Choosing a provider |
| What about agents’ providers? | Governed by the agent vendor’s terms, not rConfig’s | Which model sees your configs |
Known limits to disclose
Be upfront about these; reviewers respect it:
- MCP tokens are static Bearer tokens, not OAuth. They expire after a year by default, “No expiry” is an explicit choice, and every token created or revoked is logged.
- No AI audit screen in this release; the audit trail is queried from the database.
- No spend cap in rConfig.
- No form for team knowledge entries in this release.
Related reference
Frequently asked questions
Is rConfig's AI read-only?
Yes for devices and stored configs. No AI path writes to a device or a stored config, and the MCP server has only read-only tools. The one AI write is a draft policy definition, saved only when a user clicks save.
Can we use rConfig's AI without sending data to the cloud?
Yes. With Ollama or a self-hosted OpenAI-compatible server on your network, rConfig classifies the provider as on-premises and nothing leaves your environment.
What does rConfig log about AI use?
Every Iris request in the AI audit trail (user, IP, feature, provider, model, token counts, time) and every MCP tool call in the application log (tool, outcome, device). Prompt and answer text are never logged.