Tux — AI Assistant

Tux is the optional AI assistant built into the PrivateLAN web interface. It helps administrators find their way around the platform and can, with the right permissions, answer questions about your own network.

Where to find it

When the feature is enabled for your license and granted to your user, a small assistant button appears in the corner of every page. Open it to start a conversation in plain language. A green or red indicator shows whether the assistant can currently be reached.

What it can do

• Explain features and guide you — answers "how do I…" questions and links you straight to the correct page in the interface.
• Answer questions about your own system — for example "how many switches do I have?", "is this device reachable?", "which VLANs are on this switch?" or "which devices fail the SSL inspection?". It reads your live data only when a question needs it.
• Stay within your permissions — which data categories the assistant may read is controlled per user with the same role system used everywhere else in PrivateLAN.

What it will not do

• Read-only by default — out of the box (and always, unless an administrator explicitly changes the system-wide setting described below) the assistant explains and guides but never alters configuration or runs commands. It points you to the page where you make the change yourself.
• No sensitive data — usernames, passwords, certificates, keys and RADIUS/MAB secrets are never shown.
• No pricing or off-topic help — it stays focused on using the PrivateLAN application.

Settings (System / AI)

Administrators can control the assistant for the whole system from System / AI. See System Settings for the full configuration reference; in short:

• Mode — Disable (turns Tux off for every user), Read only (the default — Tux can only look things up), or Full control (Tux may also make changes, but only for users who are additionally granted the matching permission, and only after you approve each change).
• Backend — PrivateLAN-hosted (the default, described in the rest of this page) or a customer-supplied on-prem AI server, with an optional extra system prompt. See the note below.

Full control

In Full control mode the assistant can act on the system, not just describe it — adding a device, correcting a VLAN, bouncing a port, and so on. It does that through exactly the same programming interface and the same checks the web interface itself uses, so nothing it does bypasses the validation, permissions or licence limits that already apply.

Three things always hold in this mode:

• The assistant is marked in red. Tux's picture gets a red ring, on the button and in the window, and a warning strip appears, so it is never ambiguous whether you are talking to an assistant that can change things.
• You approve every change. Before anything runs, the assistant shows exactly what it wants to do and waits for you to confirm or cancel. Nothing happens until you press Confirm, and cancelling changes nothing. This approval is enforced by the appliance, not by the assistant, so it cannot be talked out of asking.
• Everything is recorded. Each action, and each refusal, appears in the audit log, attributed to the assistant and to the account it acted for.

The assistant can never do more than the signed-in user could do themselves. Reading and changing are granted separately, so a user may be allowed to have the assistant look something up without being allowed to have it change anything.

The assistant can also check whether a device or switch answers a ping. That is available in Read only mode as well, since it changes nothing, and needs no approval. It can ping from the appliance itself, or from the switch a device is connected to — useful when the appliance is not on that device's VLAN.

Privacy and accuracy

• Session-only history — the conversation exists only for your current session and is not kept long-term.
• Your data stays local — network data is read inside your own appliance.
• Where your questions go — by default (PrivateLAN-hosted backend), your question and the data needed to answer it are sent to PrivateLAN's chat backend to generate a reply; see the Privacy Statement for details. If your administrator instead configures a customer-supplied on-prem AI server under System / AI, your questions and data go only to that server, on your own network, and PrivateLAN's chat backend is not involved at all.
• Roughly 5-minute freshness — live network data is refreshed about once every five minutes, so very recent changes may be a few minutes old. The assistant will say so when it matters.

Roles

Granting a user the chat role enables the assistant. Additional data roles decide which categories (switches, devices, VLANs, inspection including SSL inspection, MAC table, settings, syslog) the assistant may read for that user. Full control mode also requires a separate permission before the assistant may change anything for that user — read access and write access are granted independently, and a further role covers pinging. Without any data role, the assistant can still help using the documentation only.