Tenant AI Copilot on Vareons: chat assistant for orders, loyalty, staff, and design
A chat assistant inside the merchant dashboard that reads your store data through permission-checked tools, summarizes orders, loyalty, staff, and appearance, and prepares edits as drafts that wait for your explicit confirmation.
Last verified: 2026-09-19
The tenant AI Copilot runs through POST /api/ai-copilot/chat inside the dashboard. The client sends message history with a keySource: either platform, which uses Vareons environment keys and the plan free quota, or tenant, which uses your store's encrypted API key. The client also sends the current page path as pageContext.pathname to narrow the tool list shown to the model; that is UX steering only, not a security boundary — tenant isolation stays derived from the session and is never accepted from the client.
The tools cover many categories; the most relevant for merchants are orders (get, list, overview, count, timeline, then create, update, status change, cancel, archive/restore, notes, tracking), loyalty (summary, settings, rewards, add/adjust points, redeem, redemptions, top consumers), staff (twelve read tools: overview, full profile, access list, employees, attendance, leaves, performance, payroll, insights), and store appearance (branding, website layout, static pages, global components, component settings, page resolve).
The most important security rule: the assistant never executes a mutation directly. Every mutation returns confirmation_required with one batch token for several edits, and executes only via POST /api/ai-copilot/confirm. Live-editor edits are stored as single-use drafts consumed via POST /api/ai-copilot/draft/consume. Merchant-visible text is redacted for secrets, keys, paths, and technical ids, and reasoningContent never leaves the server.
Setup steps in Vareons
Open the assistant from the dashboard
From any dashboard page, open the assistant button. The panel shows quick-prompt chips when the conversation is empty, tied to the current page path to suggest what to ask here.
Choose the key source
Choose platform to use Vareons keys with your plan free quota, or tenant to use your store API key saved at /dashboard/ai-usage/api-keys. A wrong source is rejected by the server with an explicit error.
Ask about orders, loyalty, and staff
Ask for an orders summary or one order by number, a loyalty summary or a customer balance, or a staff profile and attendance. Reads need the view permission per section; writes need create or edit.
Propose an appearance change
Ask to change a color, logo, or text on a page. Colors and logo go through the branding path, other layout through website-layout, content through static pages and components. On live-editor paths edits are kept as preview drafts.
Review, then confirm execution
Nothing executes automatically. Review the shown draft, then confirm so the client calls POST /api/ai-copilot/confirm (or draft/consume in the live editor). You can dismiss the draft with no effect.
Follow activity from the usage log
Open /dashboard/ai-usage to review the token summary, prompt logs, and the tool audit table of recent executions, and confirm the assistant did only what you approved.
Frequently asked questions
Does the assistant apply changes automatically?
No. Every edit returns as a draft with confirmation_required status and executes only after your explicit confirmation through the confirm path; live-editor drafts are single-use.
Can the assistant see other stores' data?
No. The tenant id is derived server-side from the session only and never accepted from the client, and every tool checks your permissions before running.
What is the difference between platform and tenant keySource?
Platform uses Vareons keys with your plan monthly free quota; tenant uses your store API key saved and encrypted on the keys page.
Can staff members use the assistant?
Yes, within their permissions: each tool requires the matching section permission, so an orders employee sees orders only with the orders view permission, and so on.
What happens if my plan blocks a tool category?
Tools in blocked categories are rejected with COPILOT_PLAN_TOOL_CATEGORY_DENIED before confirmation or execution, while help_docs tools stay always allowed.
Do API keys ever appear in assistant replies?
No. Visible text is redacted for secrets, keys, passwords, and technical ids on the server and in the UI, and raw tool results are never sent to the browser.
Troubleshooting
Why was my request rejected? 1) COPILOT_PLAN_TOOL_CATEGORY_DENIED means the category is blocked on your plan. 2) A rejected read usually means your section lacks the view permission — ask the store owner. 3) A rejected product creation usually means the storefront category is missing: creation requires product.category. 4) STREAM_UNSUPPORTED_PROVIDER means streaming works with OpenAI only in the current version. 5) If a live-editor draft did not apply, consume it once via draft/consume, not confirm.
Important limitations
• Mutations never execute without explicit confirmation, even if the model asks. • Streaming currently works with OpenAI only. • Word document generation is capped at 2MB before encoding. • Plan policy can hide whole categories even when you hold the permission. • Scores and helper signals are not automatic block decisions.