Run playbooks that are allowed — not whatever the model types.
Ansible connections bind inventory and playbooks into governed automated process steps. A run uses an approved playbook, sensitive credential-referenced credentials and organization policy. Chat does not get a free ansible-playbook shell.
What Ansible does here
Ansible connector. It appears when the account has it and it is deployed. Playbooks stay on an approved list; an empty list does not run.
Connections in admin
Register an Ansible connection per organization. Credentials stay in secure credential store, not in the process diagram JSON.
Allowlisted playbooks
Only playbooks and inventories listed on the connection can run. Unknown paths are rejected.
Run, plan, syntax-check
Capabilities cover run, check-mode plan, syntax-check, job status, cancel and an approved rollback playbook.
AWX where configured
A connection can target approved AWX job templates. Local playbook runs and AWX jobs share the same policy envelope.
Workspaces
Playbook files live in a workspace with published revisions. A run can pin a published snapshot instead of ad-hoc files.
From a automated process step
The canvas tool step selects the Ansible connection, connection and playbook. Control and governance still applies before execution.
Explore more
Ansible workspaces
Versioned playbook trees, published revisions and starter scenarios for a connection.
WinRM / PSRP
WinRM and PowerShell Remoting (PSRP) are one Windows connection family. You store the host and choose WinRM or PSRP, keep passwords and certificates in the vault, then test the path or run approved Windows Ansible books. Same idea as SSH: a governed connection, not a shell in the request.
Terraform
A Terraform connection points at modules you have approved. Automated processes can validate, plan, apply and show the result. Destroy stays off unless the connection allows it and a person has approved. Typical work: a Proxmox VM, deploying or upgrading a stack, preparing an environment. Provider credentials — including Proxmox API tokens — stay in the organization vault. The run can be local or over an existing SSH connection.
SSH
SSH connections store host, port, user and keys in the vault. Automated processes run approved command profiles. A free-form remote command from the model is off; a named profile is used instead.
VPN
VPN connections (IPsec / IKEv2, SSTP or WireGuard, client or server role) sit in the same governed catalog as SSH and Ansible. From a server connection in admin you generate secrets once, then download ready profiles and install commands grouped by iPhone, Android, Windows and Ubuntu. Typical path: gateway first, then SSH, playbooks or Windows remoting on the far side.
Website checks
A guest or a colleague writes. The team changes the website. Someone says yes. The pages go live. Then a real browser opens them, walks the path a visitor would, and brings a screenshot back to the team. That is website checks: the last look before you trust the change.
Connectors
The platform composes tools, capabilities and connections: MCP, REST, SQL, GitHub, SSH, Ansible, Terraform, WinRM/PSRP and other deployed connections. Calls go through organization policy and sensitive credential references.
Ready to move beyond the chatbot?
Build AI that understands your business, works with your knowledge, follows your processes and can actually finish the job. You decide which actions are allowed, when a person must step in and how much AI usage your organization can consume.