THE FIELD GUIDE / SECURITY & RESPONSE
Per-server AI pause & resume
Stop AI requests for one server while inventory, patching and deterministic protection keep running.
Pause one server, not the fleet
Administrators use the persistent AI integration panel on any server tab to pause or resume that server’s AI integration. Each change records the actor, time and reason in audit history. The setting persists across controller restarts and offline database migration. Existing servers default to resumed; management-disabled servers can preconfigure AI state without re-enabling management. Deleted servers retain read-only state.
What a pause covers
- Automatic triage and update importance scoring skip the paused server without holding up the rest of the fleet.
- Manual and queued incident proposals recheck the saved state before execution; automatic scan proposals also skip paused hosts.
- Host-scoped provider calls recheck fresh state immediately before sending, including second-stage triage and release-configuration AI.
- A shared scoring batch that contains a newly paused server is rejected as a whole before sending its payload.
What keeps working
Inventory, patching, schedules, scanning, process monitoring and deterministic CVE detectors continue independently. An enabled automatic-containment policy remains active even while AI is paused or its provider is unavailable. Historical AI results and activity stay available. Global model diagnostics carry no server data and remain usable.
In-flight requests and resume
If a provider request is already running, a pause or resume attempt returns a conflict without changing state. Wait for the request to finish, then retry and confirm the saved state. A successful pause blocks subsequent requests; it cannot retract data already sent or erase provider retention. Returned results may finish local validation and persistence.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗