AI ENGINE
BETAAn engineer that reads your fleet, and asks before it acts.
Bring your own model key. The engine has the whole context of your infrastructure and none of the authority to change it — every action it wants to take goes through a human and then through the ordinary job queue.
BRING YOUR OWN KEY
Your key, your bill, your data.
You configure a provider and a key. Talos never proxies your requests through us — there is no us in the request path, because the software is self-hosted. If you configure no provider, the engine is simply inert: nothing is contacted, and no part of your fleet is described to anybody.
The key itself is encrypted at rest with the same mechanism as your SSH keys and cloud credentials.
PROPOSAL-GATED EXECUTION
The AI never touches your infrastructure.
It has no credentials, no SSH session and no side channel. What it produces is a proposal record. A person reads the diff, approves it, and the work is enqueued exactly as if that person had asked for it themselves — same permission check, same queue, same ledger entry.
WHAT IT DOES
Four jobs, all of them reviewable.
Diagnose and fix
Reads a failed job, its logs and what changed near it, then proposes the fix as a reviewable diff rather than a paragraph of advice.
Infrastructure builder
Describe what you want and get a plan you can read — the same gated path, never a direct apply.
Scheduled reports
Fleet summaries on a schedule: what changed, what failed, what is drifting, in the language you would use in a standup.
Read-only assistant
Ask questions about your own infrastructure without granting any write access at all. Most people start and stay here.
RETRIEVAL
It reads your fleet, not the internet.
A GENERIC CHATBOT HAS
THE TALOS ENGINE RETRIEVES
Retrieval is scoped by the asking user’s permissions — it cannot surface a resource they could not open themselves.
PERMISSIONS
A proposal can never exceed the person who asked for it.
There is no service account with elevated rights behind the engine. Four separate checks apply, and all four are the same permission system the rest of Talos uses.
Visibility
The engine can only retrieve context the requesting user is already allowed to see.
Propose
Producing a proposal at all requires permission on the resource it targets.
Approve
A different person, who independently holds the permission, has to accept it.
Execute
Execution runs under the normal permission check, not under any elevated AI identity.
You pick the model per task
A scheduled report and an incident diagnosis do not need the same model. Configure them separately, see what each is spending, and change your mind without redeploying anything.
Why this is marked beta
The engine is complete and its gating is enforced in code, but it has not yet been run end-to-end against a live provider key in a production fleet. We would rather say that here than have you find out. Start it in read-only mode.
Point it at one server first.
Read-only mode grants it nothing. It can look, and it can tell you what it would do.