The new integration of AI in Zammad 7.0 in the actual state is a problem for people, companys, clubs or anyone who runs Zammad in regulated environments, with regulatory needs, privacy or environmental concerns.
Please provide an external killswitch to disable all AI and even any UI of AI in the webinterface even for admins. I suggest using a special environment variable for this use-case.
In the end, inside the UI, it’s only an opt-in, like a lot of other features, which could also be a problem related to the mentioned regulatory needs, privacy, or environmental concerns.
It’s also not possible to activate the AI functionality with a simple toggle; you need to add provider information and tokens.
When it’s really a very big problem compared to other opt-in features inside Zammad, there is also some workaround possibility to hide the “output” in the admin UI completely with the Rails console:
Permission.where("name LIKE 'admin.ai%'").update!(active: false)
I wonder how feasible that “kill switch” is, if an administrator has access to the console, they can just enable it temporarily etc. I’m just asking myself, how much you have to distrust an administrative person, that you have to restrict things so much down the road.
Don’t get me wrong. I absolutely do understand that there’s companies and situations that do not allow any use of AI, no matter where it is being hosted etc. I’m not going to argue against it, because I think it’s a perfectly fine use case. I just have trouble with above, because in my opinion such a distrusted person shouldn’t have any administrative permission at all.
The setup in one case I know about is as following:
admin-team of system engineers which installs servers, install and update applications
second admin team which manages the inside of the applications and support the users
usage of ai is prohibited because of regulations and even the second admin is not allowed to enable it.
The second admin team has no access via f.e. SSH to the servers and cannot change configurations outside of the application itself.
Okay, then Dominics shared Permission disabling is the best shot you have as of now. Ensure everything is disabled before and then disable the permissions.