// docs
Skills & Guardrails
Skills are the agent's hands. Approvals and scopes are the leash — you decide exactly what S.E.N.T.R.I can touch.
Built-in skills
These skills are always available to the agent:
| Skill | What it does |
|---|---|
| Automation | Check the dashboard for job status/IDs; restart or cancel jobs. |
| Plan Execution | Check the current time and schedule a runbook for a host. |
| Check Availability | Ping hosts or check whether a specific port is open. |
| Check Events | Read recent Application, System, or Security events from a host. |
| Check Logs | Pull the most recent ServerEngine log entries. |
Optional skills
Enable these in Settings when you need them (some require credentials or an API key):
| Skill | What it does |
|---|---|
| Admin Mode | Open a PowerShell session to a host and run commands interactively. |
| Active Directory | Search users and groups, read user info, and list group/department members. |
| Hypervisor | Manage virtual machines on Proxmox VE and VMware ESXi. |
| Web Search | Search the web and fetch page content (Brave-powered — bring your key). |
| Slack Message | Post messages to up to three Slack channels. |
| Jira | Create/read tickets and subtasks, transition status, comment, list your tickets. |
| Confluence | Create, read, and update Confluence pages. |
Custom skills from runbooks
Turn any runbook into a skill S.E.N.T.R.I can call. Give it a description and an optional parameter, and the agent can trigger the whole workflow from a natural-language request.
Approvals
Mark any skill as approval-required. When the agent wants to run it, ServerEngine pops a confirmation showing the exact skill and host and waits for you to Accept or Decline before anything executes. Decline, and the agent is told you refused and moves on.
Approvals need a human at the console
Prompt job runs headlessly with no one to ask, so approval-required skills are skipped on those runs. Scope tightly and disable what an unattended run should never touch.Scopes
A scopeis an allow-list of hosts. Build it from your server groups to define exactly which machines S.E.N.T.R.I may act on. The agent is only ever shown the hosts in the current scope and is instructed to use nothing else — so it can't wander outside your boundary.
Layered control
Admin Mode safeguards