> ## Documentation Index
> Fetch the complete documentation index at: https://docs.2501.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Quick answers to common questions about 2501

## General

<AccordionGroup>
  <Accordion title="What does 2501 actually do?">
    2501 runs autonomous AI agents on your infrastructure. You point it at machines, give it a few rules about how your environment works, and it handles tickets from your ITSM — investigating, fixing, and reporting back in the ticket itself.
  </Accordion>

  <Accordion title="Does it work without a ServiceNow integration?">
    Yes. ServiceNow is the default gateway and what most deployments run, but custom-built gateways are available for other ticketing systems — contact your account team. You can also drive 2501 from the CLI or the Command Center UI directly.
  </Accordion>

  <Accordion title="Is there a free tier?">
    Yes — a built-in free tier caps your tenant at **50 lifetime tasks** and **10 hosts** (gateways are unlimited). Once you apply a license, those caps are replaced by your contract's. See [Licensing](/0.8/configure/licensing).
  </Accordion>
</AccordionGroup>

## Agents and safety

<AccordionGroup>
  <Accordion title="How do I keep agents from running destructive commands?">
    Three layers, used together:

    1. **[Permissions](/0.8/risk/permissions)** — give agents the least-privileged credentials that still let them work.
    2. **[Blacklists](/0.8/risk/blacklists)** — programmatic blocks for specific command patterns, always on.
    3. **[Read-Only Agents](/0.8/risk/read-only-agents)** — pin a specialty to investigate-only so the agent literally cannot alter the system.
  </Accordion>

  <Accordion title="What's the difference between investigate and remediate?">
    Investigate is read-only — the agent diagnoses and reports without changing anything. Remediate is the default; the agent can act. Set per ticket with `@2501:investigate` or pin a whole specialty to investigate-only. See [Read-Only Agents](/0.8/risk/read-only-agents).
  </Accordion>

  <Accordion title="What's the difference between a Specialty and an Operational Rule?">
    A **Specialty** shapes how the agent *thinks* about a domain — vocabulary, priorities, approach. An **Operational Rule** tells it what is *true* in your environment and what that implies. Specialty: "Kubernetes Operator". Rule: "On this cluster, rollbacks go through `helm rollback`, never re-applying manifests."

    Rules outrank specialties in conflicts. See [Prompting an Operational Rule](/0.8/prompting/operational-rule).
  </Accordion>

  <Accordion title="Why is there a 5-task limit per job?">
    Hard limit, set after observing thousands of tickets. Most jobs need 1–3 tasks; headroom for 2 more covers multi-host coordination or deep investigation. If 5 tasks aren't enough, the agent is going down a wrong path — better to fail and let a human take over. See [Agentic Flow](/0.8/understand/agentic-flow#the-5-task-ceiling).
  </Accordion>
</AccordionGroup>

## Models and providers

<AccordionGroup>
  <Accordion title="What LLM providers does 2501 support?">
    Native: OpenAI, Anthropic, Mistral, DeepSeek, Cohere, OpenRouter, TogetherAI. Compatible: any OpenAI- or Anthropic-shaped API via `openai-compatible` / `anthropic-compatible`, and Azure OpenAI (including APIM). Self-hosted endpoints (vLLM, Ollama) work through the compatible types. See [Providers](/0.8/configure/providers).
  </Accordion>

  <Accordion title="Can I use different models for different agents?">
    Yes. Each agent picks its **main** and **secondary** engine from the tenant catalog. The tenant has its own defaults for gateway routing and the AI Assistant. See [Engine & Agents](/0.8/understand/engine-agents).
  </Accordion>

  <Accordion title="Why two engines per agent?">
    The main engine does the work (commands, file edits). The secondary engine plans, watches, and judges every command for compliance and read-only enforcement. Separating execution from oversight improves both accuracy and safety. See [Engine & Agents](/0.8/understand/engine-agents#the-two-engine-agent).
  </Accordion>
</AccordionGroup>

## Deployment

<AccordionGroup>
  <Accordion title="Docker Swarm or Kubernetes?">
    Docker Swarm is the default — `2501 infra deploy` manages the full lifecycle. Kubernetes (any distribution: vanilla, OpenShift, k3s, EKS, etc.) is generate-only: the CLI renders manifests you apply with `kubectl` or your distribution's equivalent, so GitOps tooling stays in charge. See [Kubernetes](/0.8/deployment/kubernetes).
  </Accordion>

  <Accordion title="How do I upgrade 2501?">
    Run an interactive `2501 infra deploy`. It lists published releases newest-first, self-updates its own binary to match the version you pick, and then deploys. No separate update command. See [Troubleshooting → Upgrading](/0.8/deployment/troubleshooting#upgrading).
  </Accordion>

  <Accordion title="Where do I configure secrets?">
    LLM API keys live in `/etc/2501/env.engine`. Per-host credentials (SSH, WinRM, gMSA, vault paths) live in **Command Center → Credentials**, encrypted at rest. Agents only access them programmatically — values are never displayed in the UI after creation. See [Credentials](/0.8/configure/credentials).
  </Accordion>
</AccordionGroup>

## Knowledge and rules

<AccordionGroup>
  <Accordion title="What file types can I upload as knowledge?">
    PDF, DOCX, CSV, and Markdown. Max 200 MB per file. PDFs with diagrams need a multimodal model on the tenant to capture the visual content. See [Knowledge](/0.8/configure/knowledge).
  </Accordion>

  <Accordion title="What if my uploaded knowledge contradicts a rule I wrote by hand?">
    Manual rules always win. The auto-extracted rule is replaced when you re-upload the same document, but your hand-written rules are untouched. See [Working with Knowledge](/0.8/best-practices/knowledge).
  </Accordion>

  <Accordion title="How do I know which rules reached a task?">
    Each task's detail page in Command Center shows a **matching trace** — which operational rules were applied, which were skipped, and why each skip happened. Use it to debug rules that are too broad, too narrow, or mistagged.
  </Accordion>
</AccordionGroup>