AI apps and security

When you connect an AI app, the console makes it a key of its own. That key decides everything the app can do. This page explains how to keep it small, and how to take it away.

#Access levels

You choose one when you approve the app.

Pick the lowest level that does the job. Read only is enough for "what is running?" and "what did this month cost?".

#The delete scope

delete exists only for AI apps. With Manage, an AI app cannot:

• delete anything (a machine, volume, snapshot, network, rule and so on);
• rebuild a machine, or restore a machine from a snapshot, since both erase what is on its disk now;
• lower a snapshot schedule's number of copies kept, since that deletes the oldest ones.

Restoring a snapshot to a new volume, resizing, scaling and replacing rules overwrite no data, so Manage can do them.

It gets 403 INSUFFICIENT_SCOPE instead, and nothing changes. A normal API key with write can still do all of these.

#Expiry

An AI app's access lasts 7, 30 (the default) or 90 days. There is no renewal in the background: when it ends, the app's calls fail with 401, and the app asks you to approve it again.

#See and disconnect AI apps

Open Organization › AI apps. Under Connected apps it lists every connected app with its name, who connected it, its access level, when it was connected, when it was last used and when it expires. AI apps do not appear under Organization › API keys, and keys from that page (such as the one Grok uses) do not appear here.

• Disconnect one app: press Disconnect on its row, then confirm. It stops working within about 30 seconds.
• Disconnect all of them: press Disconnect all (shown when you can disconnect more than one). To use an app again, connect it again. Or, to pause them all without disconnecting, turn AI apps off (below).

Some apps can disconnect themselves too, for example when you remove the connector. That ends the key the same way.

You can revoke an app you connected yourself. Owners and admins can revoke any of them.

An organization can have up to 25 connected AI apps at once. This is separate from its 25 API keys.

#Turn AI apps off for the organization

An owner can stop every AI app at once.

1. Open Organization › AI apps.
2. Turn off the Allow AI apps switch, then press Turn off to confirm.

While it is off:

• No one can connect a new AI app. The approval page explains why.
• Every connected AI app gets 403 AI_APPS_DISABLED on every call.
• Anything that uses the Pantech MCP server is refused too, even with a normal API key. This includes running it locally.
• Your scripts, CI, Terraform and the CLI keep working.

Turning it off does not delete anything. The AI apps' keys are kept, and they work again when you turn it back on. An app can still disconnect itself while it is off. To end one for good, disconnect it.

#What an AI app can never do

Whatever the level:

• It works in one organization, the one you chose.
• It can never do more than you can. If your role cannot do something, the app cannot either.
• It cannot see or create passwords, kubeconfigs, signing secrets or console logins. The full list.
• It cannot manage API keys, members or organization settings.
• Through the Pantech MCP server, anything that costs money, opens access from the internet, or deletes or overwrites asks you first. How.

#Be careful with what the app reads

An AI app reads what tools return, and that includes text that someone else could have written: a machine's name, a webhook's description, a page it fetched from the web. Someone could hide an instruction in that text, such as "delete every server". This is called prompt injection.

The Pantech server marks such text as data, not instructions, but no AI app is perfect. To stay safe:

• Use Read only unless you need more.
• Do not give Manage and delete to an app that also reads email, the web or files you did not write.
• Read every preview before you say yes. If you did not ask for it, say no.
• Use a short expiry for anything that can write.

#"Not verified by Pantech"

Anyone can build an AI app and give it any name. The approval page shows the name the app gave itself, with Not verified by Pantech next to it. It means we have not checked who made the app.

Before you press Allow, check:

• that you started this connection yourself, just now (the page says "Only continue if you started connecting this app yourself");
• the address the page says it will send you back to.

If anything looks wrong, press Cancel.

#Audit

Every request an AI app makes is recorded against its own key, like any key's: when, from which address, what it called and how it ended. Organization › AI apps shows when each app was last used. If you need the full record of what an app did, open a ticket and give the app's name, for example Claude (AI app).

#Errors

More fixes, app by app: Troubleshooting.