Prerequisites
Deployment
| Deployment | Model |
|---|---|
| SaaS | Forward provides and manages the model. |
| Self-hosted | An Anthropic Claude model in your own AWS account, accessed through Amazon Bedrock. An Org Admin sets it up as a model provider. Forward AI is unavailable until a model provider is active. |
The Available for all users switch in the Forward AI section of Org preferences turns Forward AI on or off for every user. It is on by default.
Roles and permissions
Forward AI is available to every standard role. All agent tools are read-only, so no role can use Forward AI to modify network state.
| Role | Forward AI tab | NQE tool | Configuration history |
|---|---|---|---|
| Org Admin | Yes | Yes | Yes |
| Network Admin | Yes | Yes | Yes |
| Network Operator | Yes | Yes | Yes |
| Read-Only | Yes | Yes | Yes |
| Limited Read-Only | Yes | No | No |
Limited Read-Only does not hold the USE_NQE permission, so the NQE tool is hidden from the agent for those users. A
prompt that would have required NQE is returned as out-of-scope. Generating an NQE query also requires USE_NQE, but
answering NQE documentation questions does not, so Limited Read-Only users can still ask about NQE syntax and functions.
Configuration history requires permission to view collected file diffs, which Limited Read-Only does not have. See Configuration history requirements.
Conversations are private to the user who created them. No role, including Org Admin, can view another user's chats through the UI.
Network and snapshot
When you start a conversation, Forward AI pins it to the network you have selected and to that network's latest snapshot. Both stay fixed for the life of the conversation.
- Select a network in the network picker before opening Forward AI. The conversation is scoped to that network.
- The selected snapshot must be processed at least through Stage 1 (the point at which Inventory and NQE become available). Conversations cannot be created against a snapshot that is still earlier in processing.
- A conversation keeps using its original snapshot, even after newer snapshots arrive. To analyze a newer snapshot, start a new conversation.
Data sent to the LLM
On SaaS, Forward AI uses a large language model selected and managed by Forward. On a self-hosted deployment, it uses the model provider configured on the deployment, and requests go to Amazon Bedrock in that AWS account. When the agent runs tools, it sends the relevant slice of the digital twin to the model. That slice includes device names, vendors, OS versions, interface details, NQE query results, path-search output, and CVE metadata. Tools return structured data, which can include configuration lines that an NQE query returns. When the agent uses configuration history, the model also receives the diff text of the device's configuration changes. Predict Insights send their own inputs; see Insights.
User prompts, model responses, and tool results are persisted in the Forward Enterprise database for the lifetime of the conversation. Deleting a conversation removes its messages.
Configuration history requirements
Configuration history needs all of the following:
| Requirement | Details |
|---|---|
| Forward setting | Forward enables configuration history. Contact Forward support to request it. |
| Cluster base | Supported on base v17 or later. |
| Role | See Roles and permissions. |
| Device access | The user can access the device's configuration file. If device access rules hide the file, the reply says access is denied and shows no history for that device. |
Without the Forward setting, base v17 or later, or the role permission, the agent does not offer configuration history. Questions about configuration changes then get an out-of-scope reply that asks the user to request access. Configuration history is not available through the MCP server.
Where to go next
- Using Forward AI: start a conversation and walk through the UI.
- Capabilities: what the agent can answer once you have access.