Approvals and safety

AI Pilot can change real systems, so kaiport leaves the decisions to you. This page explains which steps wait for your approval, what Autopilot changes, which commands always ask, how to restrict AI Pilot per connection and where to review what it did.

Approve or deny a step

When a step needs your approval, its card shows Awaiting approval, a question and two buttons:

• Run carries out the step.
• Deny skips it. AI Pilot is told that you declined, that it shouldn't retry the step unchanged, and that it should ask how to proceed or suggest an alternative.

The question tells you what kind of step it is: Run this command in the terminal?, Run this change? for file operations, or Run every step of this plan? for a plan in a storage tab. Dangerous steps show a warning instead, and their Run button is red: Potentially dangerous command – please review carefully. for commands, This action deletes or overwrites data – please check carefully. for file operations.

Nothing runs until you click Run

What needs approval

In terminal tabs

This applies to SSH connections.

In storage tabs

This applies to FTP, S3, WebDAV and Azure connections in the transfer view.

A plan is marked dangerous – with the warning and the red button – when it deletes something or would overwrite an existing file.

Autopilot

With Autopilot, AI Pilot works without stopping for each step. You set it in two places:

• Settings → AI Pilot → Autopilot is the default for new chats.
• The Autopilot switch in the panel's toolbar applies to the chat in that tab. You can flip it at any time, also while AI Pilot works.

If you switch Autopilot on while steps wait for approval, the ones that aren't dangerous run right away; dangerous ones keep waiting for your click. The empty chat tells you which mode is on, for example You confirm every command before it runs. or Autopilot is on – I run commands without asking.

Know what Autopilot doesn't check:

• The danger check only looks at commands. Text and keys that AI Pilot sends to an interactive program run without asking in Autopilot, whatever they contain.
• In terminal tabs, writing a file runs without asking in Autopilot, also when it replaces an existing file.

Use Autopilot where these risks are acceptable, and combine it with the per-connection lists below.

Commands that always ask

kaiport recognizes commands that can destroy data or lock you out. They wait for your approval even in Autopilot. The check looks at the whole command line, so it also catches these commands after sudo or inside a chain such as cd /tmp && ….

• Deleting recursively: rm -r, rm -R, rm --recursive, and rm -f /
• Formatting and partitioning disks: mkfs, fdisk, parted, wipefs
• Writing directly to disks: dd with of=/dev/…, and redirecting output to /dev/sd…, /dev/nvme…, /dev/hd… or /dev/disk…
• Shutting down or restarting: shutdown, reboot, poweroff, halt, init 0, init 6
• Changing permissions or owners broadly: chmod 777 (also with -R), chown -R on /
• Deleting database content: DROP TABLE, DROP DATABASE, DROP SCHEMA, TRUNCATE TABLE
• Rewriting Git history or discarding work: git push --force or -f, git reset --hard, git clean -f
• Killing many processes: kill -9 -1, killall, pkill -9
• Dropping the firewall or network access: flushing iptables or nft rules, ufw disable, ufw reset, and systemctl stop, disable or mask for SSH, network or firewall services
• Changing users and passwords: passwd, userdel, usermod, deluser, groupdel
• Removing packages: apt, apt-get, yum, dnf, zypper or pacman with remove, purge, autoremove or -R
• Deleting all cron jobs: crontab -r
• Running a downloaded script: curl or wget piped into sh or bash, also with sudo
• Erasing traces or data: history -c, shred
• The shell fork bomb :(){ :|:& };:

Denied and allowed commands per connection

For each SSH connection, you can limit which commands AI Pilot may run:

1. In the start window, open the connection's menu (…) and choose Edit.
2. Switch to the AI tab.
3. Fill in Denied commands (AI), Allowed commands (AI) or both.
4. Click Save.

Denied commands (AI) are refused, even in Autopilot. When Allowed commands (AI) contains patterns, AI Pilot may only run commands that match one of them; everything else is refused.

Rules for one connection

How the patterns work:

• Write one pattern per line. Each line is a regular expression, matched without regard to upper and lower case.
• A pattern matches when it's found anywhere in the command line: systemctl restart also refuses sudo systemctl restart nginx. Use ^ to match only at the start, for example ^ls.
• Denied patterns are checked first. A command that matches a denied pattern is refused even if it also matches an allowed one.
• A line that isn't a valid regular expression is ignored.
• A refused command doesn't run. Its card shows denied, AI Pilot is told not to retry it and to tell you instead, and the audit log records Blocked.
• The lists apply to commands only. Keys sent to interactive programs and file operations are not checked against them.

Examples for denied commands:

systemctl (restart|stop)
\bdocker\s+rm\b
rm -rf /var

Examples for a read-only allow list:

^ls\b
^cat\b
^systemctl status\b
^journalctl\b

Limit the number of steps

Settings → AI Pilot → Max. steps per request (default 30, from 1 to 100) sets how many rounds of tool calls AI Pilot may make for one message. When it reaches the limit, it stops working on the request. Send another message, such as "continue", to let it go on. A low limit keeps runaway tasks short; a higher one suits long maintenance jobs.

The audit log

kaiport records every command and file operation of AI Pilot in a local log. Open it with Settings → AI Pilot → AI audit log → View log. The dialog lists the most recent 300 entries, newest first. Each entry shows:

• the decision,
• the command, or the arguments of a file operation,
• the paths the step read or changed,
• the host, the date and time, and for commands the exit code.

A command usually appears twice: once when it's released and once with its exit code when it has finished.

Settings → AI Pilot → AI audit log

Show file reveals ai-audit.jsonl in your file manager. The file contains one JSON object per line with the fields at (time in milliseconds), connection, host, tool, command, decision, exitCode, note and paths, so you can search or process it with other tools. kaiport only ever appends to it.

Calls of other AI tools through kaiport's MCP server follow these rules too, except that only reading runs without a click and Autopilot does not apply; see MCP server.

Good practices

• Start without Autopilot on a new server. Watch what AI Pilot does before you let it work alone.
• Read each command before you click Run, especially cards with a warning.
• Write the rules of a server into AI instructions for this connection, for example "Production system – never restart services without asking."
• Refuse what must never happen with Denied commands (AI).
• Connect with a user account that only has the rights the task needs.
• Type passwords into the terminal, never into the chat.
• Check the audit log after longer Autopilot sessions.