Knowledge

What is the Knowledge Hub?

The Knowledge Hub is where you give Aiden context about your organization, such as architecture notes, operational guidance, postmortems, and runbooks. You decide what belongs together by creating a hub for a team, system, or purpose. Aiden then processes and indexes that content so agents can retrieve relevant information during conversations and workflows.

How do I add content?

Open Knowledge in Aiden, select or create a hub, then add text, upload files, or connect a supported source. Connected Confluence and GitHub sources can sync selected spaces, pages, repositories, directories, or files into the hub.

What is global knowledge?

A global hub participates in general chat retrieval and is the default knowledge source for workflows that do not select a specific hub. Use it for context that applies broadly, such as organization-wide standards, shared architecture, or common terminology. Keep team- or system-specific content in a non-global hub and select that hub in the workflows that need it.

How do agents find and use knowledge?

Agents search for the most relevant parts of the knowledge available to the current execution instead of loading every document into each prompt. General chat uses global hubs. A workflow can select one or more specific hubs to limit retrieval to that content; when it selects none, it uses Global Knowledge.

Privacy

Does Aiden scrub PII and API keys before sending them to the LLM?

Yes. Aiden runs a built-in redaction step on the way to the model, not as a separate vendor sub-processor. Before each model call it scans user messages and tool results and replaces likely personal data and secret-shaped strings (API keys, tokens, passwords, high-entropy secrets, credit-card-like numbers) with [HIDDEN:…] placeholders. The model sees the placeholders. Tools that need the original value can restore it when they run.

The scanner is the same open-source engine as PII-Shield: entropy analysis, context-aware key detection, Luhn checks, and deterministic HMAC hashes. Aiden embeds that scanner in-process. It does not send your chat to a PII-Shield cloud API, and it is not the Kubernetes log sidecar from that project.

This is a best-effort heuristic, not a guarantee. Novel formats, unusual embeddings, and values that look like ordinary words can still reach the provider. Do not paste production secrets into chat when you can use Vault instead.

For vault credentials vs telemetry vendors, see the Telemetry, PII & vault secrets FAQ.

What is and isn't redacted?

Redacted by default (when redaction is on): chat you type, and output from tools such as email or search, right before that text is sent to the model. Streamed tool arguments in the watch UI follow the same per-agent policy.

Not redacted at that boundary: the agent’s system instructions and earlier assistant replies. Secrets you put in an agent persona or a workflow prompt go to the model as written.

Sometimes skipped: unattended runs (cron, webhooks, API workflow starts) skip this LLM-boundary scan on purpose, because those prompts are treated as operator-authored. Some agents also turn redaction off (pii_redaction:disabled) so infrastructure IDs stay visible; prefer allow rules for Grafana UIDs and cluster names instead of disabling the scanner.

Can we add our own fields to hide or keep?

Yes. Each agent can layer deny and allow regex rules on top of the platform scanner.

  • Deny hides extra patterns the global scanner misses (for example an internal EMP-###### badge).
  • Allow keeps matching values visible when the scanner would otherwise hide them (for example Grafana rule UIDs). Allow wins over deny and over the global scanner.

Configure this on the agent in Aiden (pii_redaction) or in Terraform (sg_agent.pii_redaction, provider 0.1.32+). The incident-triage scenario shows a deny/allow overlay you can demo.

Is this the same engine as PII-Shield?

Yes. Aiden uses the PII-Shield scanner (entropy, context keywords, custom and safe regex, deterministic [HIDDEN:…] hashes). That library is what actually looks at the text before it goes to the LLM.

PII-Shield also ships a Kubernetes log sidecar. Aiden does not run that sidecar for model calls. It embeds the scanner in the control plane so prompts are redacted locally, with no extra PII-Shield SaaS hop.