# Conduktor Agents *Your Kafka clusters never sleep. Neither should your agents.*Conduktor agents help every team keep their clusters secure, reliable, well-governed, and cost-efficient. They investigate issues across your environment and bring you the fix. [Try it free](https://www.conduktor.io/get-started?src=console-agents-hero) [Talk to us](https://www.conduktor.io/contact/demo?src=console-agents-hero) Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Weekly cost change by team Ask A Show me each team's Kafka cost and what changed since last week. Thinking… Reading your cluster… Looked at your cluster · 2 calls · 2s Listed applications*38 ms* Read chargeback*412 ms* Payments and insurance drove the increase. Ecommerce and analytics were flat. I compared the last 7 full days (19–25 Oct) with the 7 days before (12–18 Oct). | Application | 12–18 Oct | 19–25 Oct | Change | | --- | --- | --- | --- | | payments | 9,954 | 11,756 | **+1,802 (+18.1%)** | | insurance | 4,329 | 5,025 | **+696 (+16.1%)** | | ecommerce | 3,704 | 3,690 | −14 (−0.4%) | | analytics | 1,972 | 1,949 | −22 (−1.1%) | | **Total** | 19,959 | 22,420 | **+2,461 (+12.3%)** | - **payments:** Egress is the main cause, up about 1,488 (3,362 → 4,850). Bytes out rose from roughly 50–70 GB a day to 70–90 GB a day. - **insurance:** Egress is up about 511 (1,260 → 1,771). Ingress and storage also crept up. Open Chargeback Why did payments egress rise? Check this every Monday. Thinking… Ask Conduktor… Skills AI can make mistakes, check what matters. Task Access Condition Review Review Back Create agent Check the agent before creating it. You can edit any section later. Task Name**Weekly cost by team** Task**Chargeback report** Model**Claude Sonnet 5.5 · claude-sonnet-5-5** Access Identity**agent-chargeback-report · admin@demo.dev** Condition Type**Schedule** Frequency**Weekly** Day**Monday, 09:00 UTC** Ask Conduktor Creates the Weekly cost by team agent, running every Monday at 09:00 UTC. Dismiss Weekly cost change by team Check this every Monday. Worked on the page · 21 calls · 41s The agent is set up but not created yet. Press **Create agent** to save it. I used the **Chargeback report** skill, which compares each application's cost this period with the previous one and explains what moved it. These are the settings I chose: - **Name:** Weekly cost by team - **Identity:** agent-chargeback-report. It was the only identity with the permissions this task needs. - **Schedule:** weekly, Monday at 09:00 UTC. Ask anything… /for skills AI can make mistakes, check what matters. ## You decide what each agent can do From reports to automatic fixes. Every agent starts by reporting. Move it up when you trust it, and every action stays within the agent's permissions. "level": "report" ********** **Report**agent finds**Recommend**agent proposes**Approve**you approve**Automate**agent applies Unblock orders-service on orders partition 2 Stuck consumer fix Report Recommendation Pending Applied Produced a few seconds ago · agent orders-service stuck consumer watch Approved in advance Reject **Approve Approved **Stuck group:** orders-service on kafka-prod-eu has sat at offset 50 on orders partition 2 for 5h 42m, 10,382 records behind and rising. The record at offset 50 is cut off mid-JSON. The other five partitions are caught up. Looked at · 3 calls · 11s consumer group lag partition offsets record at offset 50 What to check next: parse errors at offset 50 in the orders-service logs, and the producer checkout-api/4.12.0. Proposed fix 1 Skip offset 50 on orders partition 2 for orders-service 2 Confirm the group is consuming again and lag is falling Pending your decision. Nothing has been applied. Applied by the agent, approved in advance. orders-service is consuming again, lag 0. **The agent finds the problem.**It tells you what it found and what to check. You take it from there. **The agent proposes the fix.**Step by step, with the evidence. You decide whether to apply it. **Nothing changes until you approve.**One click, and the agent carries out the steps. **The agent applies the fix.**Approved in advance for tasks you trust. Every step is on the record. ## What agents do for you The checks that feel like chores, on a schedule. Pick your seat. Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Local Kafka local-kafka-cluster Consumer Groups orders-service orders Ask A orders consume rate 412.6 msg/s offset lag 49,142 time lag 14m 12s Search by name 1-6 of 6 Partition Member Consume rate End offset Commit Offset lag 0 **orders-service-1***/10.4.2.17**3F2A91C4* 71.2 *msg/s* 2,418,906 2,418,715 191 1 **orders-service-1***/10.4.2.17**3F2A91C4* 69.8 *msg/s* 2,402,331 2,402,109 222 2 **orders-service-2***/10.4.2.18**B7D0E655* 70.4 *msg/s* 2,395,772 2,395,428 344 3 **orders-service-2***/10.4.2.18**B7D0E655* 0.0 *msg/s* 2,431,118 2,382,908 48,210 4 **orders-service-3***/10.4.2.19**9C41AD08* 68.9 *msg/s* 2,409,540 2,409,381 159 5 **orders-service-3***/10.4.2.19**9C41AD08* 72.1 *msg/s* 2,421,087 2,420,871 216 orders-service Stable Topics*1* Members*3* Alerts*0* ****Graphs Topic Partitions Members Offset lag Time lag **orders** 6 3 49,142 14m 12s Search by any field Name Status Active Last trigger Destination No alerts New Alert Alert details Alert destination Name*** Alert name Alert ownership*** Define who can manage this alert. This cannot be changed after creation. **Group **Application **Only me Kafka cluster local Consumer group orders-service Metric*** OffsetLag Select a metric Target topic*** All topics Operator > Value*** 10000 0 Comments Write your notes... External Send alert notifications to external tools for team-wide visibility **** Slack Teams Webhook Email Destination channel Enter or select a channel Check if your alert is working Send test Cancel Next Save Why orders-service is falling behind How can I help? Ask about your topics, consumer groups, schemas or how Conduktor works. Is this cluster healthy? Which consumer groups are lagging? Which topics have no consumer? How do I give a team its own topics? Why is orders-service falling behind? Thinking… Reading your cluster… Looked at your cluster · 2 calls · 6s Read consumer group orders-service*64 ms* Read topic orders*212 ms* Almost all of the lag is on partition 3 of orders: 48,210 of 49,142 messages. That partition is assigned to orders-service-2. Its commits stopped 14 minutes ago, while the other two instances keep up with the topic. Worth checking that instance first: the consumer is still in the group, so it is not a rebalance. Alert me if lag on orders goes over 10,000. Thinking… Working on the page… Worked on the page · 10 calls · 9s Went to orders-service*402 ms* Clicked Alerts 0*288 ms* Clicked Create an alert*251 ms* Filled Name with orders-service-lag-over-10k*296 ms* Picked Only me in Alert ownership*241 ms* Picked OffsetLag in Metric*337 ms* Picked > in Operator*312 ms* Filled Value with 10000*274 ms* Clicked Next*263 ms* Left Save for you to press*18 ms* The alert is filled in but not saved yet. Press **Save** to create it. Send it to Slack Also watch time lag Ask anything… /for skills AI can make mistakes, check what matters. Ask Conduktor Saves the alert. You'll hear about it when lag on orders passes 10,000. Dismiss Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Ask A Local Connect Refresh Add connector Search by name... Class Type State 1-8 of 8 Connector name Type State Tasks Failed Tasks ********** ********** ********** ********** ********** ********** ********** ********** datagen-customers DatagenConnector Running 1 0 datagen-customers-json DatagenConnector Running 1 0 datagen-pageviews DatagenConnector Running 1 0 datagen-payroll-employee DatagenConnector Running 1 0 datagen-payroll-employee-location DatagenConnector Running 1 0 postgres-sink JdbcSinkConnector Running 0 1 postgres-sink-dlq JdbcSinkConnector Running 1 0 wikipedia ServerSentEventsSourceConnector Running 1 0 Unblock postgres-sink: send pageviews offset 6282 to a DLQ and move past it Approval Failing sink connector, find the poison pill Pending Approved Produced 3 hours ago · agent Failing sink connector Reject Approve Output Trace Pending your decision: nothing has been applied The agent wrote no changes. Approving records your decision for the steps below; a person carries them out. Approved by admin@demo.dev a few seconds ago Finding **Connector:** postgres-sink reads pageviews. Its task 0 is FAILED (0 of 1 tasks running). Proposed steps 1. Stop postgres-sink on Connect cluster local-connect. 2. Create the dead-letter topic pageviews.dlq with 1 partition. 3. Copy pageviews partition 0 offset 6282 to pageviews.dlq, then read it back. 4. Reset connect-postgres-sink on pageviews partition 0 from 6282 to 6283. 5. Resume postgres-sink, restart task 0 and check the lag keeps falling. 6. Tell the team producing to pageviews about the record. 7. Add errors.tolerance=all and a dead-letter queue to postgres-sink. Why postgres-sink is failing **How can I help?**Ask about your topics, consumer groups, schemas or how Conduktor works. Which connectors are failing? Why is a connector task failing? Why is postgres-sink failing? Thinking… Reading your cluster… Looked at your cluster · 4 calls · 14s Listed connectors on local-connect*41 ms* Read connector postgres-sink*84 ms* Read connector task postgres-sink*112 ms* Searched topic records on local*230 ms* The postgres-sink task is failing because it hit a record on pageviews that isn't Confluent-Avro encoded. The connector still shows RUNNING, but its only task is FAILED (0 of 1 running). The record that broke it is pageviews, partition 0, offset 6282: a single plain-JSON message in a topic of Avro records. Open the approval Show offset 6282 Ask anything… /for skills AI can make mistakes, check what matters. Approve this proposal? Approving **Unblock postgres-sink: send pageviews offset 6282 to a DLQ and move past it** records your decision. Nothing is executed. The steps the agent proposed are for someone to carry out. Reason (optional) Kept with the approval, for whoever reads it later Cancel Approve Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Local Kafka local-kafka-cluster Service Accounts legacy-etl Ask A Service Accounts New ACL Search by name... 1-8 of 8 Name app-a app-b app-c app-x bi-tool legacy-etl migration-job reporting-svc legacy-etl View in Lineage Add label ACLs All resource ACLs assigned to this service account. **Topics** *(1)* * Host: * All Alter AlterConfigs Create Delete DescribeConfigs Describe Read Write + Add Topic ACL **Consumer Groups** *(1)* * Host: * All Describe Delete Read + Add Consumer Group ACL Over-privileged service accounts How can I help? Ask about your topics, consumer groups, schemas or how Conduktor works. Is this cluster healthy? Which consumer groups are lagging? Which topics have no consumer? How do I give a team its own topics? Who has more access than they need? Thinking… Reading your cluster… Looked at your cluster · 2 calls · 12s Listed service accounts*52 ms* Listed acl bindings*140 ms* Two accounts stand out on local-kafka-cluster. - legacy-etl holds All on every topic and every consumer group, from any host. It should be scoped to the topics and groups the ETL job uses. - bi-tool has Read on the prefix p, which matches payments-* and payroll-*. That is probably wider than intended. Open legacy-etl Who uses bi-tool? Ask anything… /for skills AI can make mistakes, check what matters. Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Ask A Lineage view Live** Topics** Graph Data flow Back Select a Service account to start Search for a resource Service accounts**8** Connections**142** Topics**49** Show Topics Show Service accounts User:legacy-etl 49 49 User:bi-tool 0 8 User:app-c 5 5 User:app-x 4 4 User:migration-job 1 0 User:app-a 3 3 User:app-b 4 4 pageviews payment-transactions payments-incoming payroll-employee payroll-employee-location shipment-tracking all service accounts > payroll-employee **Live 49 49 User:legacy-etl 0 8 User:bi-tool 4 4 User:app-x payroll-employee customers pageviews aws.identity.cdc.customers.json.v1 insurance-customers payroll-employee-location payments-incoming 1.4 KB/s ************************ Personal data and who can read it **How can I help?**Ask about your topics, consumer groups, schemas or how Conduktor works. *Is this cluster healthy?**Which consumer groups are lagging?**Which topics have no consumer?**How do I give a team its own topics?* Which topics hold personal data, and who can read them? Thinking… Reading your cluster… Looked at your cluster · 9 calls · 21s Listed topics*45 ms* Checked topic insights*53 ms* Searched topic records*230 ms* Read topic payroll-employee*88 ms* Read topic customer-profiles*91 ms* Listed acl bindings*140 ms* Read service account legacy-etl*62 ms* Read service account bi-tool*58 ms* Read lineage payroll-employee*310 ms* Six topics hold personal data in clear. The most sensitive is payroll-employee, with SSNs and pay rates. legacy-etl can read it through All on every topic, and bi-tool through Read on the prefix p. Neither account is owned by an application. Open payroll-employee Who should own legacy-etl? Ask anything… /for skills AI can make mistakes, check what matters. Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Ask A Chargeback *View by***Application** *Show***All costs** 7D 30D 6M 12M YTD **Export as CSV** Overall cost $87,611.00 $44,266.00 **20.11%***since 30D ago* **29.81%***since 30D ago* Storage cost $28,206.00 $13,323.00 **3.35%***since 30D ago* **3.67%***since 30D ago* Partition cost $22,611.00 $10,450.00 **3.23%***since 30D ago* **2.59%***since 30D ago* Ingress $9,561.00 $4,671.00 **13.27%***since 30D ago* **21.62%***since 30D ago* Egress $27,233.00 $15,822.00 **56.97%***since 30D ago* **77.83%***since 30D ago* **Key Metrics** **Storage **Partitions **Ingress **Egress Cost Percentage ********** **$4K****$2K** **$3K****$1.5K** **$2K****$1K** **$1K****$500** **$0****$0** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** ******** 26 Sep 30 Sep 04 Oct 08 Oct 12 Oct 16 Oct 20 Oct 24 Oct Search applications 1-4 of 4 1-1 of 1 Application 26 Sep 27 Sep payments **$1.4K***49.82% 100%* **$1.4K***49.68% 100%* insurance **$606***21.69%* **$612***21.79%* ecommerce **$520***18.61%* **$523***18.63%* analytics **$276***9.88%* **$278***9.9%* Payments cost this week **How can I help?**Ask about your topics, consumer groups, schemas or how Conduktor works. Is this cluster healthy? Which consumer groups are lagging? Which topics have no consumer? How do I give a team its own topics? Why did payments cost more this week? Thinking… Reading your cluster… Looked at your cluster · 1 call · 2s Read chargeback payments*1.2 s* Egress is the main cause, up about 1,488 (3,362 → 4,850) of the 1,802 increase. Bytes out rose from roughly 50–70 GB a day to 70–90 GB a day. Show payments by day Which topics drove egress? Ask anything… /for skills AI can make mistakes, check what matters. ## Set up an agent in four steps Bring your own model, on your own account: Claude through Anthropic or Amazon Bedrock, OpenAI, or any OpenAI-compatible endpoint. Home Ask Conduktor Agents Console Topics Schema registry Consumer groups Kafka Connect Kafka Gateway Brokers Service accounts SQL engines Analytics Insights Chargeback Lineage Settings main Run “Low-use insight” Ask A Run “Low-use insight” Thinking… Looking at your cluster… Looked at your cluster · 6 calls · 9s Listed clusters*38 ms* Checked cluster insights on local*41 ms* Searched topics on local*63 ms* Listed consumer groups on local*52 ms* Listed applications on local*35 ms* Read chargeback on local*212 ms* Read-only task: nothing was changed *Empty topics***2** *Stale topics***1** *Owner cost per month***$326** Topics to review inventory.snapshotsNo writes in 63 days and no readers. Owner: inventory **$142/mo** orders.retry.v1Empty for 41 days. Owner: checkout **$96/mo** payments.audit.tmpEmpty since it was created. Owner: payments **$88/mo** Expand Schedule it Ran on demand · not saved to Outputs Ask Conduktor… Skills Run a skill now Cluster summary*Report**Per-cluster size, health and topic-type split from Console's insights. Reads everything, writes nothing.* Chargeback report*Report**Cost per application this period against the previous one, with the movers explained.* Lineage report*Report**The most and least connected topics and principals, and whether the ACL set matches.* Risk insight*Report**Topics Console flags as low replication, skewed or lopsided, each joined to its owner.* VIP insight*Report**The most valuable topics per cluster with their readers, owners and owner cost.* Low-use insight*Report**Empty, stale and tiny topics and empty or dead consumer groups, each with an owner to ask and the owner's cost.* Ownership coverage*Report**Self-service coverage per cluster and topic family, and the uncovered topics.* Certificate expiry watch*Suggestions**Certificates approaching expiry, with a rotation call to action.* AI can make mistakes, check what matters. Task Access Condition Review Set up your agent Continue Name the agent, pick the task it runs and the model that runs it. Name*** Task*** Select a task Low-use insight Model*** Select a model Claude Sonnet 5.5 · claude-sonnet-5-5 **Low-use insight**Report Empty, stale and tiny topics and empty or dead consumer groups, each with an owner to ask and the owner's cost. Trigger kind Schedule Required permissions Cluster View ACL Consumer group View Platform Can list clusters Can view Chargeback Topic Consume What can it see? Back Continue Pick the identity the agent runs as, and how often it is allowed to run. Identity*** Select an identity insight-low-use-report-local · admin@demo.dev The task only sees what this identity can see. Actions are attributed to it. **Need a new identity?**Create one without leaving this page. Permissions are taken from what this task needs on the selected cluster. Cluster*** Select a cluster Local Kafka Create new identity with permissions for Low-use insight ****** **insight-low-use-report-local** was created and selected for this agent. When should it run? Back Continue Run on a fixed cadence, or react to changes in your clusters. **On a schedule**Hourly, daily, weekly or monthly. **On an event**When a topic, subject, consumer group or connector changes. Low-use insight can only run on a schedule. Frequency Hourly Daily Weekly Monthly Day Monday Time*** 09:00 AM Timezone UTC If a run is missed Skip missed Review Back Create agent Check the agent before creating it. You can edit any section later. Task Name**Weekly unused topics check** Task**Low-use insight** Model**Claude Sonnet 5.5 · claude-sonnet-5-5** Access Identity**insight-low-use-report-local · admin@demo.dev** Condition Type**Schedule** Frequency**Weekly** Day**Monday** Ask Conduktor Creates the identity this task needs. Dismiss Ask Conduktor Creates the agent. It runs every Monday at 09:00 UTC. Dismiss Run “Low-use insight” Schedule “Low-use insight” as an agent Thinking… Working on the page… Worked on the page · 6 calls · 11s Read the page*31 ms* Filled Name with Weekly unused topics check*286 ms* Clicked Continue*257 ms* Read the page*29 ms* Picked Local Kafka in Cluster*350 ms* Pointed you to Create new identity with permissions for Low-us…*32 ms* No identity has the permissions this task needs yet. Press **Create new identity**, then I'll carry on. Done, continue Done. Carry on from where you stopped. Thinking… Working on the page… Worked on the page · 6 calls · 8s Read the page*36 ms* Clicked Continue*256 ms* Picked Weekly in Frequency*279 ms* Picked Monday in Day*268 ms* Clicked Continue*257 ms* Pointed you to Create agent*21 ms* The agent is ready but not created yet. Press **Create agent** to save it. It runs as insight-low-use-report-local every Monday at 09:00 UTC. Ask anything… /for skills AI can make mistakes, check what matters. Task Access Condition Review Set up your agent Continue Name the agent, pick the task it runs and the model that runs it. Name*** Task*** Select a task Low-use insight Cluster summary*Per-cluster size, health and topic-type split from Console's insights. Reads everything, writes nothing.* Chargeback report*Cost per application this period against the previous one, with the movers explained from chargeback alone.* Lineage report*The most and least connected topics and principals, and whether the ACL setup makes the lineage view trustworthy.* Risk insight*Topics Console flags as low replication, skewed or lopsided, each joined to its owning application and that application's cost.* VIP insight*The most valuable topics per cluster with their readers, owners and owner cost, and whether they are protected.* Low-use insight*Empty, stale and tiny topics and empty or dead consumer groups, each with an owner to ask and the owner's cost.* Ownership coverage*Self-service coverage per cluster and topic family, and the uncovered topics that are most used.* Model*** Select a model Claude Sonnet 5.5 · claude-sonnet-5-5 Claude Opus 5*Anthropic · claude-opus-5* Claude Sonnet 5.5*Anthropic · claude-sonnet-5-5* GPT-5.5*OpenAI · gpt-5.5* Qwen3 235B*Amazon Bedrock · qwen.qwen3-235b* **Low-use insight**Report Empty, stale and tiny topics and empty or dead consumer groups, each with an owner to ask and the owner's cost. Trigger kind Schedule Required permissions Cluster View ACL Consumer group View Platform Can list clusters Can view Chargeback Topic Consume What can it see? Back Continue Pick the identity the agent runs as, and how often it is allowed to run. Identity*** Select an identity agent-insight-low-use-report · admin@demo.dev The task only sees what this identity can see. Actions are attributed to it. agent-insight-low-use-report · admin@demo.dev agent-certificate-expiry-watch · admin@demo.dev*Missing permissions for this task: Platform: can view chargeback · Cluster: view acl · Consumer Group: view · Topic: consume* agent-acl-hygiene-watch · admin@demo.dev*Missing permissions for this task: Platform: can view chargeback · Consumer Group: view · Topic: consume* agent-sensitive-data-guard · admin@demo.dev*Missing permissions for this task: Platform: can view chargeback · Cluster: view acl* Quiet period (seconds) Optional Max runs per hour Optional When should it run? Back Continue Run on a fixed cadence, or react to changes in your clusters. **On a schedule**Hourly, daily, weekly or monthly. **On an event**When a topic, subject, consumer group or connector changes. Low-use insight can only run on a schedule. Frequency Hourly Daily Weekly Monthly Day Monday Time*** 09:00 AM Timezone UTC If a run is missed Skip missed Review Back Create agent ****** Check the agent before creating it. You can edit any section later. Task Name**Weekly unused topics check** Task**Low-use insight** Model**Claude Sonnet 5.5 · claude-sonnet-5-5** Access Identity**agent-insight-low-use-report · admin@demo.dev** Condition Type**Schedule** Frequency**Weekly** Day**Monday** ## AI agents need more than a Kafka service account Kafka decides what an agent can reach. Here's what that leaves out. ** **Who is it acting for?** A principal, not a person. Acts for Priya Shah. **What can it see?** READ means every field. Masked as it is for Priya. **What can it change?** Allowed means done. No approval. Waits for your approval. **How do you stop it?** Rotate the key, break the apps. Revoke one identity. You could build these guardrails yourself. **You don't have to.** *01 · Identity***Give every agent its own identity**Each identity is linked to a named user and limited to that user's permissions. New identity Name agent-topic-cleanup Shown in the identities list and the audit log. Acts for Select a user PPriya Shah** The identity is limited to the permissions of this user. Expires No end date 30 Jan 2027 Valid until revoked. Expires on 30 Jan 2027. *02 · Least privilege***Only the access its task requires**Choose the task and cluster, and Console selects only the permissions that task needs. Resource access Pre-fill from a task Permissions for "Low-use insight" Select a task Low-use insight** Select a cluster prod-eu** Pick a task and the cluster it will run on. 2 resource permissions selected below. Review them, then continue. **Topic*(1 policy)* **Consumer Group*(1 policy)* **Subject **Connector *03 · Data protection***Sensitive data stays masked**When an agent reads data through Console, the same masking rules apply as for the user it acts for. As **agent-stuck-consumer** reads it"order_id": "o-81723", "amount": 129.90, "email": *"********"*, "card": *"********"* As **Priya Shah** sees it"order_id": "o-81723", "amount": 129.90, "email": *"********"*, "card": *"********"* Same rules, same mask. *04 · Human approval***You decide what agents can change**Agent-proposed changes require your approval by default. For tasks you trust, enable Automate to let the agent act without waiting for review. agent-connector-recovery wants to**Restart failed task 2 of orders-sink** - Restart task 2 of orders-sink - Confirm the task is RUNNING *Reject**Approve* **Approved by you. Task restarted. *05 · Visibility & revocation***See every agent. Revoke access individually.**See who each agent acts for. Revoke one identity without touching the others. Identities Name Acts for Last used Status agent-topic-cleanup *P*Priya Shah 2 min ago *Active**Revoked* agent-claude-code *S*Sam Lee 5 min ago *Active* agent-cost-weekly *P*Priya Shah 1 h ago *Active* agent-schema-check *S*Sam Lee 20 min ago *Active* agent-cert-expiry *S*Sam Lee 6 h ago *Active* agent-acl-audit *P*Priya Shah 3 days ago *Revoked* **Revoke identity?**This cannot be undone. The identity stays listed as revoked for audit purposes. *Cancel**Revoke* *06 · Runtime safety***Keep every run within limits**A looping or runaway agent stops on its own, without anyone watching. **20**model calls** **50**tool calls** **500k**tokens** **10 min**per run** **3×**the same call stops the run *07 · Bring your own agent***Your agents. The same security controls.**Connect any MCP client with a Console identity token. The same access restrictions and masking apply. **Claude Code **Cursor **Codex Token kZ7qP2vR8sXw4mN1aB6cDw==.••••••••3f9a**Copy Copied** **Next steps**Use this token in your MCP client configuration, or select this identity when creating an agent. ``` claude mcp add --transport http conduktor \ https://console.acme.io/api/mcp \ --header "Authorization: Bearer $CONDUKTOR_TOKEN" ``` *08 · Deployment & model control***Your infrastructure. Your choice of model.**Console and its agents run in your environment, on a model provider you choose or one you host yourself. Your network **Agents********Console********Kafka ********Your model*your account, or self-hosted* Conduktor*nothing goes here* Trusted by ## AI gets Kafka right with Console We asked the same AI the same questions about a large Kafka cluster, with and without Console. Without Console **13%**correct answers The AI only sees raw Kafka. It guesses. With Console **90%**correct answers The AI sees what Console knows: who uses what, who owns it, what it costs. From Conduktor's agent benchmarks, September 2026. ## Frequently Asked Questions **What does an agent actually do?** It runs a task: one of 13 built-in tasks, such as cost reports, schema drift or connector recovery, or one you describe. See [an agent set up in four steps](https://www.conduktor.io/product-demos/set-up-a-kafka-agent-in-4-steps#demo-video) (1:04). On each run it uses only the tools its identity allows, works from what Console already knows about your clusters, and returns a finding with its evidence and a next step. **Can an agent change my cluster?** Only as far as you let it. Reports and recommendations change nothing. An approval proposes the exact steps and waits for a person. Automation carries out steps you pre-approved, agent by agent, and every run is recorded. **What can an agent see?** What the identity you give it can see, and never more than the person or team that owns it. Permissions are checked on every call. Revoke the identity and its access ends. See [agents for platform engineers](https://www.conduktor.io/product-demos/conduktor-agents-for-platform-engineers#demo-video) (0:43), an access review in 43 seconds. **Can I use my own agent?** Yes. Create an identity in Console and give its token to any MCP client, such as Claude Code, Cursor, Codex or your own script. It talks to Console's MCP tools under that identity, with the same permissions and masking as a built-in agent. **Where does the data go?** Agents work mostly from metadata, such as topic names, configurations, lag and permissions, and read messages only for tasks that need them. That goes to the model you connected, on your own account. With a model you host yourself, nothing leaves your network. Nothing is routed through Conduktor. Findings, traces and approvals stay in your Console. **Which models does it support?** Your choice, on your own account: Claude through Anthropic, Claude and other models on Amazon Bedrock, OpenAI, or any OpenAI-compatible endpoint such as Azure OpenAI, or a model you host yourself with vLLM or Ollama. The built-in tasks were tuned on Claude first, so it gives the most consistent results. **What is Ask Conduktor?** A chat in Console that ships with Agents. Ask about topics, consumer groups, schemas, cost or access from any page, with your own permissions. It can fill in forms and set up an agent from a sentence, and leaves the final click to you. **Which Kafka does it work with?** Any cluster Console connects to, whether you run it yourself or use a managed service such as Amazon MSK, Confluent Cloud or Aiven. **Is it a separate product?** No. Agents are a part of Console and use the clusters, identities and data already in it. **How do I get it?** Agents ship with Conduktor Console. Install Console, turn agents on in its configuration, connect your model, and create your first agent. Agents are free to use at launch. Or talk to us and we'll run one on your environment with you. ## Build more on Kafka. Stay in control. Agents ship with Conduktor Console. Try them free, or talk to us and we'll run one on your environment and read its first findings with you. [Try it free](https://www.conduktor.io/get-started?src=console-agents-footer) [Talk to us](https://www.conduktor.io/contact/demo?src=console-agents-footer)