PanlyticsDevelopers
Make a key

Guides

Drive the app as an AI

Let an AI agent open the Panlytics app in its own browser, signed in as the key's maker, behind the fence and with a band that says so.

When to use it

Most work is simpler through the API: it is faster, it is exact, and it is what the agent prompt points at. The app is for the moments the API does not cover: looking at a chart, reading a product's page the way a person sees it, or checking that a change looks right before a person is told about it.

Before you start

  1. The CEO switches on Let an AI sign in to the app on the organisation's Developer page. Developer mode must be on. Letting an AI sign in to the app explains the setting and its limits.
  2. The agent holds a live key.
  3. The agent has a browser of its own: a separate browser profile, or a headless browser it starts itself. Panlytics refuses to sign an AI in over a person who is already signed in in that browser.
curl
curl -X POST https://panlytics.net/api/v1/agent-sign-in-links \
  -H "Authorization: Bearer $PANLYTICS_KEY"

The answer is 201 with a url and its expiresAt. The link works once, within one minute, so ask for it just before you open it. The maker may ask for six links an hour; past that the call answers 429 agent.links_limit with Retry-After. While the setting is off it answers 403 agent.sign_in_off.

2. Paste it into the address bar

The agent pastes the whole url into the address bar of its own browser, or navigates to it directly, the way a person types an address. A link clicked on another page is not spent: Panlytics only signs in a link that arrives from the address bar, so another site cannot sign a browser in with somebody's link.

The secret part of the link is after the #, so the browser never sends it to a server. The app opens signed in as the key's maker, and a band across the top of every page says "An AI is signed in as Maria until 14:00."

From there the agent uses the app the way a person would, on the pages its maker can see, inside the fence. Security, Billing, Data, People, Roles, the audit log, the AI budgets and the Developer pages answer as if they did not exist. Integrations, approvals and the person's own settings answer agent.not_for_ai.

3. Let it end

The session ends when the key ends or is revoked, or the moment the CEO switches the setting off. The agent cannot extend it. To keep going, the person makes a new key and the agent asks for a new link.

What the people see

  • The band, on every page, for as long as the AI is signed in.
  • A notice in the app and an email to the CEO and to the key's maker, each time an AI signs in.
  • The session in the maker's list of devices, named "AI". Ending it there also revokes the key.
  • Every change it makes, in the audit log, under the maker's name and marked as done by an AI.