Help assistant

The help assistant answers questions about this appliance from inside it: it knows which screen you are on, reads the appliance's live configuration, and can name the actual misconfiguration rather than describing the feature in general. Settings → Help assistant governs one decision about it — whether the questions people type are checked by your own input filters before they reach a model.

What do I need?

Licence

Any

Role

superadmin

Prerequisites

• You sign in as superadmin. The pane states this itself: only the superadmin can configure the help assistant.
• For conversational answers, at least one active model. Without one the assistant still answers, from the built-in product catalog.
• For the multi-step assistant, an Anthropic credential resolvable for the tenant.
• For question inspection, at least one PII filter on this tenant. With none, there is nothing to inspect.

Screenshot pendingSettings → Help assistant showing the Off, Flag and Mask choices and the category list/assets/screenshots/settings-help-assistant@0.4.png

Three ways it can answer

The assistant does not have a mode setting. It picks the best mode it can serve on each request, and the answer says which one answered.

Mode 0 is a floor, not a failure: an air-gapped appliance whose only models are red-team builds still gets help. Models whose names suggest a red-team, uncensored, abliterated or jailbreak build are excluded from consideration entirely, and local models are preferred over remote ones — because a help question carries this appliance's live configuration, and every remote candidate is one more chance for that to be answered from somebody else's datacentre.

HELP_TOOLS_MODEL pins the model used in mode 2; it defaults to a small, fast Claude model. HELP_FORCE_MODE set to 0, 1 or 2 narrows what is attempted, for lab verification. It can only narrow: forcing mode 2 without a credential still falls through.

What the assistant can and cannot do

It reads, and it proposes. It never writes.

It can read the live state of your input and output filters, list the shipped baselines, search the product catalogue, and offer you a button to a page. For an administrator it can additionally propose a filter change as a dry-run diff, propose one cataloged configuration action, and offer a filter bundle as a download.

Every one of those ends at a card in your browser. Applying it is a second request that your own browser makes, with your own session, to the real administrative endpoint. Nothing in the gateway writes on the assistant's behalf, and the assistant is instructed never to claim otherwise. A proposal also re-reads the current value immediately before you apply it, so a setting that changed in the meantime is shown to you rather than silently overwritten.

A destination the assistant offers is resolved against the appliance's own page registry, so a hallucinated link cannot reach your browser at all.

What is sent to the model

Your question, and a summary of the current screen's configuration. Never message content, never detected values, never customer traffic.

That summary is configuration: how many filters exist, which are switched off, what your own rules are named. Filter names are operator-authored text, so the appliance labels them as data and instructs the model not to treat them as commands.

The help window is deliberately outside the tenant content policy. That is a correctness decision as much as a privacy one — a question about toxicity filtering is a guaranteed false positive for a toxicity filter — and it is structural: there is no "skip filters" flag on the chat endpoint that a caller could ask for. The one part you can opt back in is PII inspection, below.

Turn on question inspection

Fields reference

Both are read by GET /help/settings and written by PUT /help/settings. The pane renders the gateway's own description of each setting verbatim, so what you read there is what the code says.

Rate limits protect the assistant rather than the reader: 20 questions per five minutes, and 10 policy-document analyses per hour, counted per tenant.

Inspection fails open. An unreadable setting is treated as off, and an inspection that errors sends the question through unchanged rather than blocking the person asking for help.

Verify

1. With inspection Off, open the help window. The disclosure reads This conversation is not filtered by your security policy — avoid pasting real customer data.
2. Set it to Mask, save, and ask a question containing a test value your PII filters detect. The reply carries a notice saying your organisation's input filters replaced the values with placeholders before sending, and names the types and counts — never the values.
3. Open Event logs. The question wrote HELP_INPUT_MASKED in the security category, with the detection count and entity types and no question text. On Flag it writes HELP_INPUT_FLAGGED instead.
4. The save itself wrote HELP_SETTINGS_UPDATED in the audit category, naming who changed what, from which value to which.
5. Ask the assistant a question and read the footer of the answer. It names the model that answered, or states that the answer came from the built-in product catalog.

If it fails

• Only the superadmin can configure the help assistant. → you are signed in with another role.
• Unknown filter name(s) for 'input_filtering_categories': … → a selected category no longer matches a live filter. The pane also warns Some selected categories no longer exist and explains the consequence: a selection naming only deleted filters narrows inspection to nothing while still reporting success.
• 'input_filtering' must be one of: off, flag, mask. → an unsupported value was sent to the API.
• Too many help requests, please try again in a few minutes. → the rate limit. The Guides tab keeps working.
• The help window says No AI model configured → no active model resolves. Answers come from the catalog. Add a credential and a model to get conversational answers.
• The reply carries The model did not return a usable structured reply, so this answer is text only → the single-pass model produced malformed output. The text still answers; navigation and proposals were dropped for that turn.
• The assistant claims it changed something → it cannot. Check the setting yourself; nothing is applied until you press the button on the card.
• A policy-document upload is refused with Unsupported file type → upload PDF, DOCX or TXT.
• The document is n characters; the maximum is … → trim the upload to the privacy and data-handling sections.

Next steps

• Input filters — the PII categories this pane can narrow to.
• Event logs — where help detections and setting changes are recorded.
• Settings — the other panes, and which role reaches them.