Responsible AI Usage
Kyro tries to be a helpful agent, but it sometimes gives answers that are incorrect or misleading. AI models can produce text that sounds right but isn't grounded in your data. This is often called hallucination. Treat Kyro as a fast first pass, not as the only source of truth, and check anything that affects production, security or cost.
Why Kyro can be wrong
| Cause | What it looks like |
|---|---|
| Model limits | An answer that sounds confident but names a resource, setting or value that doesn't exist |
| Your role limits what Kyro can see | Kyro works with your role, so an answer can miss workflows, stacks or policies your role can't access |
| Data Kyro can't reach | Some data isn't available to Kyro, such as run costs or policy evaluation outcomes. Kyro should say so, but it may sometimes guess |
| An ambiguous question | "Why did my deploy fail?" can match several workflows or runs, and Kyro may pick the wrong one |
| Data that changed | Runs, drift and resources change all the time. An answer can be out of date a few minutes later |
| General knowledge | For questions about Terraform, cloud services or how StackGuardian works, Kyro relies on general knowledge, which can be incomplete or outdated |
How to check an answer
- Open the resource. When Kyro names a workflow, run, stack or policy, open it in StackGuardian and confirm the details.
- Read the source, not just the summary. For a failed run, check the run logs yourself before acting on Kyro's explanation.
- Check the numbers. For counts and charts, compare with the matching view in the platform, especially before you share them.
- Use the docs for how-to questions. For how a feature works, confirm in the StackGuardian docs.
- Ask Kyro to show its work. Ask which resources or runs an answer is based on, then check them.
How to get better answers
| Instead of | Try |
|---|---|
| "Why did my deploy fail?" | "Why did the latest run of the payments-api workflow fail?" |
| "Show me drift" | "Show my top 10 drifted resources in the payments workflow group" |
| "Are we compliant?" | "Show our posture summary and the top 5 misconfigured resources" |
| "Fix it" | Switch to Plan mode and ask: "Plan how to fix the failed run of payments-api" |
- Name the resource. Use the exact workflow, stack, run or policy name when you know it.
- Set the scope. Add a time range, workflow group or environment.
- One question at a time. Split long, multi-part requests into steps.
- Correct Kyro in the chat. If an answer is wrong, say what's wrong. Kyro uses that in the rest of the conversation.
- Start a new chat for a new topic. Old context can steer answers in the wrong direction.
How StackGuardian limits the impact of a wrong answer
A wrong answer shouldn't turn into a wrong change. Kyro has these safeguards:
- Ask mode is the default. In Ask mode, Kyro only reads and answers. It can't change anything.
- You approve every plan. In Plan mode (beta), Kyro drafts the steps and waits for you to approve them before anything runs.
- Risky actions wait for you. In Build mode (beta), Kyro shows the tool and what it affects before it runs, updates or deletes anything, and waits for your approval. Before a delete, it shows what still uses the resource.
- Kyro works with your role. It can't do anything your role doesn't allow.
- Kyro never approves workflow runs. Approval gates on runs stay with people.
Before you approve, check that the tool and the resource on the approval card are what you expect.
Report a wrong answer
Your reports help us make Kyro more accurate. When you contact StackGuardian support, include:
- What you asked, word for word
- What Kyro answered, and what was wrong
- The workflow, stack or run it was about
- The mode you were in: Ask, Plan or Build