Set Up Axonius AI for Your Team

Turn on Axonius AI, choose how it behaves, decide which roles can use it, and give each role a credit allowance.

Before You Start

• You are signed in as a System Admin.
• Your Axonius environment is a SaaS deployment.
• Axonius has added AI credits to your environment. You can view them in Credit Management (Step 4).
• You have one test user per role you plan to enable.

Users can't chat until they have credits. Only the System Admin role has a credit allowance by default. Every other role needs one from you in Step 4.

Setup Steps

1. Enable Axonius AI
2. Review General Settings
3. Grant role permissions
4. Give credits to roles
5. Verify

---

1. Enable Axonius AI

Turn on AI chat and assistant capabilities for your environment.

Where: Settings › AI Settings › General Settings

Steps:

1. Open General Settings.
2. Turn on Enable Axonius AI.

Check:

• The Axonius AI chat opens for your admin account.
• Ask a test question such as "How many devices do we have?" The response should include the query it used.

---

2. Review General Settings

Decide how Axonius AI behaves for everyone in your environment. These settings apply to all users.

Where: Settings › AI Settings › General Settings

Approval for changes: Before the AI makes a change, such as running an Enforcement action, creating a dashboard, tagging assets, or sending a message, it shows a preview. The user chooses Approve, Modify, or Cancel.

Check:

• Auto-Deletion matches your retention policy.
• Scheduled Task Emails and Long Term Memory match your data-handling rules.

---

3. Grant Role Permissions

Choose which roles can use Axonius AI and what each one can do with it.

How Access Works

• The AI uses the user's own permissions, no more. Actions such as creating dashboards or running Enforcement actions still depend on the user's regular Axonius permissions.
• The AI sees only what the user sees. If a role is limited to certain subnets or business units, AI answers are limited the same way.
• A role needs AI Agent Interact (this step) and a credit allowance (Step 4) before its users can chat.

Where: Settings › Roles › [role] › AI Agents

AI Agents Permissions

Suggested Starting Points

• Analyst: AI Agent Interact
• Power user: AI Agent Interact, AI Agent Share Conversations
• Admin: All AI Agents permissions

Steps:

1. Open the role and find the AI Agents section.
2. Select the permissions for that role. Avoid selecting the AI Agents parent checkbox unless the role should get every AI permission, since it selects all of them.
3. Save, then repeat for each role.

Check:

• Sign in as a test user without AI Agent Interact. The chat should be unavailable.
• Sign in as a test user without AI Agent Administer. AI settings should be unavailable.

---

4. Give Credits to Roles

Give each AI-enabled role a credit allowance so its users can start using Axonius AI.

Concepts

• Bucket: A batch of credits added to your environment, with a name, size, and expiry date. You can have up to two at once.
• Allowance: The number of credits one user can use from one bucket. Each user has a separate allowance in each bucket.
• Role default: The allowance every user in a role receives, including users who join later.
• Override: A per-user allowance that replaces the role default.

Rules

• You can't allocate more credits than a bucket has unallocated. Save is disabled if a change would exceed this.
• Usage draws from the bucket that expires first, then the next.
• When a bucket expires, its unused credits are lost. Other buckets are unaffected. Expired buckets are hidden after 30 days.
• Lowering a role's allowance below what some users have already used blocks those users immediately. The drawer shows how many before you save.
• The System Admin role starts with a default of 10 credits.

Where: Settings › AI Settings › Credit Management

Steps:

1. Open Credit Management. Each bucket shows its size, expiry, allocated, used, and unallocated credits.
2. Go to the By Role tab and click Edit on a role.
3. Select a bucket and enter the credits per user.
4. Choose whether to apply the change to users already in the role. If you don't, only users who join later receive the new amount.
5. Review the change to the bucket's unallocated credits, then save.
6. Repeat for each AI-enabled role and each bucket it should use.
7. (Optional) On the By User tab, set an override for anyone who needs a different amount.

Tip: Keep some credits unallocated. If a bucket runs out, users who join a role later receive no allowance, and you receive an alert instead.

Check:

• Every AI-enabled role has a role default in at least one live bucket.
• Each bucket still has unallocated credits for new users.

What Blocked Users See

• They used up their allowance.
• They have no allowance.
• The environment has no credits left.

---

5. Verify Before Rollout

Confirm the setup works end to end, then announce the feature.

1. Sign in as each test user and ask a question their role allows.
2. Sign in as a user in a role with no allowance. They should see the "no allowance" message.
3. Open the Activity Log. AI-initiated actions appear as [UserName] (By Agent).
4. Open Credit Management and confirm test usage appears.