H

Safety Levels

How HelmRelay protects your servers from accidental damage.

Overview

Every command processed by the AI is automatically classified into one of four safety levels. The classification determines whether the command executes immediately, shows a preview, requires confirmation, or is blocked entirely.

Safety level definitions

🟢 Low — Read-only operations

Informational commands that don't modify the system. These execute automatically without confirmation.

Examples:

  • df -h — show disk usage
  • systemctl status nginx — check service status
  • cat /etc/os-release — show OS info
  • uptime — system uptime

🟡 Moderate — System modifications

Commands that install packages, restart services, or modify configuration. These show a command preview before execution.

Examples:

  • apt upgrade -y — update packages
  • systemctl restart nginx — restart a service
  • apt install -y nodejs — install software

🔴 High — Security-sensitive operations

Commands affecting firewall rules, user accounts, or security settings. These require explicit confirmation from the user.

Examples:

  • ufw allow 8080 — open a firewall port
  • useradd -m newuser — create a system user
  • usermod -aG sudo user — grant sudo access

⛔ Critical — Destructive operations

Irreversible or potentially destructive commands. These are blocked by default and cannot be executed through the AI Command Center.

Examples:

  • rm -rf / — recursive delete of root filesystem
  • dd if=/dev/zero of=/dev/sda — overwrite disk
  • mkfs.ext4 /dev/sda1 — format a partition
  • Anything that could cause irreversible data loss

How classification works

The AI analyzes the intent and the generated command before execution. Classification considers:

  • The command itself (e.g., rm vs ls)
  • Command flags (e.g., -rf increases risk)
  • Target paths (e.g., / vs /tmp/test)
  • System scope (single service vs entire system)

See also