Letting an AI sign in to the app

What it is

Some work is easier on the app's own pages than through the API: looking at a chart, checking a product's page, following a link someone sent. This setting lets an AI agent that holds a live key open the app in a browser, signed in as the key's maker.

It is the one way into Panlytics without a passkey or a code, so it is off unless the CEO switches it on, and it carries every limit a key carries and a few more.

Switching it on

Only the CEO can switch it on, on the organisation's Developer page, in the panel Let an AI sign in to the app:

1. Developer mode must be on first.
2. Type let an AI sign in in the field under the switch, to show it is meant.
3. Switch it on and press Save. Panlytics asks for a recent sign-in if yours is not.

Switching it off asks for nothing, and ends every AI session in the company at once. Switching developer mode off switches this off too, and revokes every key.

How a sign-in works

1. The agent calls POST /v1/agent-sign-in-links with its key. While the setting is off, the call answers 403 agent.sign_in_off.
2. Panlytics answers 201 with a url and its expiresAt. The link works once, and only for one minute. The secret part of the link sits after the #, so a browser never sends it to a server, and it is in no log and no Referer.
3. The agent pastes the link into the address bar of its own browser. A link opened from another site, or clicked on a page, is not spent: the page says to paste the whole link into the address bar instead. This stops another site from signing a browser in with somebody's link.
4. The app opens signed in as the key's maker, in the key's company.
5. A band across the top of every page says so: "An AI is signed in as Maria until 14:00." The time is in the reader's own time zone.
6. The CEO, and the key's maker when that is somebody else, are told every time, in the app and by email. The AI cannot mark that notice read. The maker's list of devices names the session "AI".

The maker may ask for six links an hour. The seventh answers 429 agent.links_limit with a Retry-After header holding the seconds to wait.

When a link cannot be spent, its page says why: it was already used, it ran out, the setting is off, or the key has ended. The agent asks for a new link with a live key.

Use a separate browser profile

In Chrome, a new profile is under the profile menu, Add. A fresh headless browser, as most agent tools start, is already separate.

What it reaches

An AI signed in to the app is behind the same fence as a key, so it sees the shops and categories its maker's role covers and may do what that role may do, minus the fenced abilities. Of the settings it may open the company overview, read the integrations, and change the report settings its maker's role allows.

What it can never do

It never reaches Security, Billing, Data, People, Roles, the audit log, the AI budgets, or handing the CEO seat over. The personal Security and Account pages and both Developer pages answer as if they did not exist. It also never:

• makes, extends or revokes a key;
• connects or disconnects an integration, such as Shopify or Netvisor, or starts a sign-in with one;
• approves what an agent proposes, approves, replaces or retires a fact in a shop's memory, or decides a product basket: a person does those;
• changes the person's profile, email, password, passkeys, two-step setting or notification switches, or switches company;
• counts as a recent sign-in, so no page that asks a person to confirm it is them will open for it;
• uses any sign-in route but reading its own session and signing out.

Anything it tries anyway answers agent.not_for_ai. The full fence is on What an AI can never do.

How it ends

The session never outlives the key that opened it. It ends at once when:

• the key reaches its end or is revoked;
• the CEO switches the AI sign-in off, or developer mode off;
• the maker changes their password or signs out everywhere, or loses the ability to make keys;
• a person ends the AI's row in their list of devices. Its button says Sign out and revoke its key, because that also revokes the key, so the AI cannot sign straight back in.

Every request checks the key again, so whichever of these happens, the next page the AI opens is the sign-in page.

What is recorded

The sign-in is written to the audit log under the maker's name, marked as done by an AI, with the key's id. So is the link it asked for, every change it makes, and its end. A run it starts in the app carries the key's id, so its proposals wait for a person, and revoking the key stops it.