AI Commands

This is KairosLink's remote administration console. It opens from any device record and lets you run commands on that machine without taking remote control, with AI assistance that helps put the command together when you do not have it to hand.

It is the most powerful tool in the product and the one that calls for the most judgement. This guide covers it in full, including what you should know before using it on a customer.

First: what information travels to the AI

This comes first because it weighs most heavily on how you decide to use the console.

Everything in the conversation travels to the AI provider, unfiltered. That includes four things:

• What you type
• The commands that get run
• The complete output of every command
• The AI's previous answers

Each command's output is saved into the conversation as soon as it finishes, without you asking the AI anything. And every time you talk to it, the whole conversation is sent.

In practical terms: if you run a command that lists domain users, dumps a configuration, prints the contents of a file or returns a connection string, that content will go out to the provider the next time you talk to the AI on that device.

There is no secret detection, no truncation and no exclusion list. There is no way to mark a command as sensitive.

The conversation cannot be deleted. The Clear button hides the messages in your browser and nothing more: they stay stored, they come back with Restore history, and they still travel on the next query. They are only deleted when the device is deleted.

How to work with this

Three concrete recommendations:

1. If a command might return something sensitive, run it and then do not talk to the AI on that device. The output stays stored, but it only travels if there is a later query.
2. For customers with regulated data (healthcare, accounting, legal), agree with your team on what may be run from here and what goes through remote control instead.
3. There is one conversation per device and it is shared. All your technicians write into the same thread and read what the others wrote. There are no separate or private conversations.

Getting in

Device record, AI Commands tab.

Viewing the console and running commands are two different things. Opening the screen and reading the history requires no special permission. Running a command or talking to the AI requires the run-commands permission, which Owner, Admin and Technician have by default.

You also need the execution capability over that particular device.

The screen

Two columns with a draggable divider, and an action bar on top.

Left column: Conversation with the AI. You describe what is going on and it proposes the command.

Right column: Command execution. The terminal where commands are typed and run, with one block per command.

They are two separate text boxes on purpose: so a sentence does not end up in the shell and a command does not end up going to the AI.

In the top bar: Actions, View assessments, Restart agent, Export and Full screen.

The device decides the shell

Above the command box there is a fixed label reading Bash or PowerShell, according to the device's operating system. It cannot be changed.

If the operating system could not be determined, Operating system not determined appears along with a selector so you can choose.

Running a command

You type in the box on the right and press Run, or Enter.

There is no confirmation. Not for ordinary commands and not for destructive ones. Pressing Run sends the command straight to the customer's machine.

There is no blocklist and no content filter. The panel does not block, warn or score the risk of what you type. A command that deletes files, shuts down the machine or disables a service runs exactly like any other.

That is a design decision: this is an administration tool and whoever types is responsible for what they type. But it is worth knowing before granting someone the permission.

The only limits are structural: the script cannot exceed 8000 characters, and a message to the AI cannot exceed 2000.

While it runs

The block appears in the terminal the moment you press, and the status chip changes: Queued, Running, Done.

There is no partial output and no progress. The output appears in full when the agent finishes and reports.

Each finished block has three buttons: Analyse with the AI, Copy the command and Copy the output.

If the device is powered off

The command stays queued and runs when the device comes back, no matter how long that takes. It never expires.

Keep that in mind: queueing five commands on a powered-off machine means all five will run, one after another, when it starts up.

The AI assistance

You describe the problem in the left column and it proposes a command, which appears as a code block with its own Run button.

The AI proposes, it does not execute. It has no way of running anything on its own: a person always has to press the button.

That said, pressing that button does not ask for confirmation either. If you accept the suggestion without reading it, it runs just as if you had typed it yourself. Read what you are about to run.

The suggested command's shell is always decided by the device's platform, not by whatever the AI said.

What the AI knows about the device

Less than you might expect, and that is on purpose.

On Windows it receives no device data at all: no name, no hostname, no customer, no IP, no domain. It only receives the conversation.

On Linux it receives the operating system and version, so it can propose commands for the right package manager.

What it does know, on both platforms, is everything in the conversation. Which is the point of the first section of this guide.

Usage and cost

There is no quota or usage limit on the console. You can talk to it as often as you need.

The Analyse with the AI button on each block exists precisely so the query happens only when you ask for it, rather than automatically at the end of every command.

The Actions menu

Four entries, all Active Directory. On a Linux device the Actions menu does not appear.

Entries are greyed out if the device is not a Domain Controller, with the reason in the tooltip. If the role could not be determined, they stay enabled.

The Active Directory assessment sends the complete Domain Controller survey to the AI provider to write the report. Your customer's Active Directory data does travel there. It is capped at 5 per month per organization, 1 during the trial.

The history

For each command it stores: who ran it, when it was queued, when the agent picked it up, when it finished, the script verbatim, the exit code and the complete output.

The history is permanent. There is no automatic purge. It is only removed when the device is deleted.

Any technician with access to that device can see it. There is no per-user private history: everyone sees everything that was run on that machine.

The Export button downloads the device's complete command log as a text file.

Command statuses

A Queued command never expires. A Running command the agent never returns is marked Timeout after 60 minutes.

Windows, Linux and macOS

On macOS the console sends bash. The Active Directory Actions menu is drawn anyway, because the panel shows it on everything that is not Linux.

What it does not do today

• There is no confirmation before running, not even for destructive commands.
• There is no filter or blocklist on what gets run.
• The conversation cannot be deleted. "Clear" only hides it in the browser.
• There are no separate conversations: one per device, shared across your whole technical team.
• There is no partial output: everything appears at the end.
• There is no AI usage quota on the console.
• The AI cannot run anything on its own, and there is no way to give it that ability.

Frequently asked questions

Can the AI run commands by itself? No. It proposes, and a person always has to press Run.

Is my command output sent to the AI? Yes, if you talk to the AI again on that device. The output is saved into the conversation as soon as the command finishes and travels in full on the next query.

Can I delete a device's conversation? No. The Clear button only hides it in your browser. It is only removed when the device is deleted.

Can another technician see what I typed? Yes. There is one conversation per device and it is shared.

I ran a command on a powered-off device. It stays queued and runs when the device comes back. It does not expire.

Does the panel warn me if a command is dangerous? No. There is no blocklist and no warnings. The judgement is yours.

Can I change the shell? No. The device's operating system determines it. A selector only appears if it could not be detected.

A command is stuck in Running and never comes back. It gets marked Timeout after 60 minutes.

How long is the history kept? Indefinitely, until the device is deleted.

How many Active Directory assessments can I run? Five per month per organization, one during the trial.