AI assistant troubleshooting

This section lists common AI assistant problems and how to resolve them. A Reference ID shows with most error messages in the assistant panel. Quote it when contacting Axiomatics Customer SupportOpens in a new tab.

Every message fails with "The assistant could not be reached"

The assistant service is not deployed, not running, or not ready.

1. Confirm that services.hubAiService.enabled is true. Read the AI assistant deployment section for details.

2. Check the pod status.

   kubectl get pods -l app.kubernetes.io/component=hub-ai-service

3. If the pod does not start or is not ready, check that the model-credentials secret exists and contains values for api-key and base-url, and that the database can be reached.

Answers fail with a model provider error

The pod can be reported as ready while every request to the model fails, because only the presence of the model configuration is checked. The cause is identified by the error message.

Error message starts with	Cause	Resolution
The language model provider rejected the assistant's credential	The API key is invalid or expired.	Rotate the API key.
The configured language model is unknown to the provider	The model ID is wrong, or the version path, for example /v1, is missing from the base URL.	Check the chatModel Helm value and the base-url secret key.
The language model rejected an option of the request as unsupported	A request option, such as the reasoning effort, is not accepted by the model. Or the request exceeds the model's context window, because the policy, the data read by the assistant, or the conversation is too large.	Use the tested model, or contact Axiomatics Customer Support to adjust the request options. For a large request, click New conversation, select only the part of the policy in question, or use a model with a larger context window. Read the Token usage and cost section for details.
The language model provider is rate limiting the assistant	The provider's usage limits are reached.	Wait and retry, or raise the limits with your provider.
The language model provider could not be reached in time	Network access to the provider is blocked or slow.	Check outbound access from the cluster to the provider.

Answers appear all at once

Responses are buffered by a reverse proxy in front of Authorization Hub. Disable response buffering for the assistant path /api/ai-assistant/. For NGINX, set proxy_buffering off; and a proxy_read_timeout greater than the total answer time. Read the Response time limits section for details.

An answer stops with "Stopped: this turn ran out of time"

The time limit for the answer was reached. The parts already shown remain valid. Ask a narrower question, for example about one rule instead of the whole policy.

A new message is not accepted

One message is answered at a time in a conversation. Wait for the current answer to finish, or click Stop.

Apply is not shown, or overwrites edits

• Apply is shown only if the policy was open in the editor when the question was sent. Open the policy and ask again.
• Apply replaces the open policy with the proposed version, so edits made after the question was sent can be overwritten. Click Undo to revert the change, then ask again with the current version open.
• With Auto-apply, a change is not applied if the policy was edited after the question was sent. Click Apply, or ask again.