AI Assistant (Tagnet AI)

Tagnet AI is Tagnet's built-in AI assistant. It allows users to ask natural language questions about inventory, locations, transactions, device activity, and application features. Tagnet AI uses function calling to query Tagnet data in real time, backed by either Azure OpenAI or a local Ollama model server.

Note: Tagnet AI is an experimental feature. Most operations are read-only. Administrators have limited ability to make configuration changes through the assistant.

Feature Overview

Tagnet AI can answer two kinds of questions:

Data questions -- "How many items moved through Warehouse B this week?" Tagnet AI calls Tagnet services to retrieve live data and summarizes the results.
Application questions -- "How do I move items automatically when a reader sees them?" Tagnet AI searches the built-in documentation and answers based on official help articles.

All queries respect the current user's access scopes and permissions. Tagnet AI can only see data the logged-in user is authorized to view.

The header of the Tagnet AI drawer has its own help icon. Click it to open this article.

Asking About the Current Page

Tagnet AI knows which page you asked from. When the page has a help article (any page whose header shows a help icon), each question tells the assistant the page's address and which help article describes it. Questions such as "How do I use this page?" are then answered from that page's article instead of a guess.

Try questions like:

"What is this page for?"
"How do I use this page?"
"What can I do here?"

For example, on a location's Floor plan tab, "What is this page for?" is answered as the Floor Plans view.

A few things to know:

Pages without a help icon: The assistant is not told the page, so "this page" questions work best on pages that show a help icon. On other pages, name the feature in your question (for example, "How do floor plans work?").
What is shared: Only the page's address and its help article are shared with the assistant. The page title is not. If the address contains anything other than Tagnet's own page names, record numbers, and IDs (for example, from a link someone edited), only the help article is shared.
Always current: The page is sent with each question and is not kept in the conversation. After you move to another page, your next question uses the new page.

Enabling Tagnet AI

Tagnet AI is disabled by default. It is only active when an AI provider is configured: Azure OpenAI (recommended for production) or a local Ollama server. When neither is configured, the chat button does not appear in the UI. If both are configured, Azure OpenAI is used.

On-premises installs should use the Tagnet AI page in the Admin Console: choose the provider, enter the endpoint, key and deployment, click Test, then Save and restart. The JSON below is the manual alternative, and is also what hosted deployments set through environment variables.

To enable Tagnet AI with Azure OpenAI, configure the AzureOpenAI section in your configuration:

"AzureOpenAI": {
  "Endpoint": "https://your-resource.openai.azure.com/",
  "ApiKey": "",
  "DeploymentName": "gpt-5.4-nano",
  "MaxAutoInvokeAttempts": 10,
  "Temperature": "",
  "MaxOutputTokens": 4096
}

Setting	Required	Default	Description
`AzureOpenAI:Endpoint`	Yes	`""` (disabled)	Azure OpenAI resource endpoint URL. When empty, Tagnet AI is completely hidden.
`AzureOpenAI:ApiKey`	No	`""`	API key for authentication. When empty, Managed Identity is used instead.
`AzureOpenAI:DeploymentName`	No	`gpt-5.4-nano`	The model deployment name in your Azure OpenAI resource.
`AzureOpenAI:MaxAutoInvokeAttempts`	No	`10`	Maximum number of function-calling iterations per request. Limits runaway cost from ambiguous prompts.
`AzureOpenAI:Temperature`	No	`""` (omitted)	Sampling temperature, 0 to 2, written as a quoted string. Leave blank to omit it from the request.
`AzureOpenAI:MaxOutputTokens`	No	`4096`	Cap on tokens generated per response.

Choosing a Model

Deployment names differ per Azure OpenAI resource, so DeploymentName must match a deployment that exists in your own resource and region.

Tagnet calls Azure OpenAI through the Responses API, so any deployment that offers function calling on that API works, including reasoning models. Supported models:

GPT-5 family: gpt-5.4-nano (the default), gpt-5-mini, and the other GPT-5.x deployments. These are the models most deployments run today.
GPT-6: gpt-6-sol, the deployment Tagnet is tested against. GPT-6 reasoning models accept tools only on the Responses API, which is why Tagnet uses it. Other GPT-6 deployments are expected to work the same way but have not been tested.

Each request carries the conversation from Tagnet and asks the service to store nothing, so Azure keeps no copy of the chat; conversation history lives in Tagnet only (see Limitations).

Two settings need attention when pointing Tagnet at a different class of model:

Temperature is omitted by default, and should usually stay that way. Reasoning models reject an explicit temperature and return an error, which fails the request rather than just changing the answer's style. Set it only for a model documented to accept it.
Max output tokens covers everything the model generates. On a reasoning model that includes its internal thinking, which can consume most of the budget before the answer starts. Too low a value produces an answer that stops mid-sentence rather than a shorter one, so raise it when moving to a reasoning-class deployment.

If answers arrive truncated, raise MaxOutputTokens before concluding the model is a poor fit.

Local Models with Ollama

For development, testing, or deployments that must keep all data on-premises, Tagnet AI can use a local Ollama server instead of Azure OpenAI. On-premises, the easiest route is the Admin Console's Tagnet AI page: choose Ollama, enter the Server URL and Model, and click Test. Test confirms the server answers and that the model has been pulled. To configure it by hand, leave AzureOpenAI:Endpoint empty and configure the Ollama section:

"Ollama": {
  "Endpoint": "http://localhost:11434",
  "Model": "llama3.2",
  "MaxAutoInvokeAttempts": 10,
  "Temperature": "",
  "MaxOutputTokens": 4096
}

Setting	Required	Default	Description
`Ollama:Endpoint`	Yes	`""` (disabled)	Ollama server URL. Used only when `AzureOpenAI:Endpoint` is empty.
`Ollama:Model`	No	`llama3.2`	The Ollama model name. Pull it first with `ollama pull <model>`.
`Ollama:MaxAutoInvokeAttempts`	No	`10`	Maximum number of function-calling iterations per request.
`Ollama:Temperature`	No	`""` (omitted)	Sampling temperature, 0 to 2, written as a quoted string. Leave blank to omit it from the request.
`Ollama:MaxOutputTokens`	No	`4096`	Cap on tokens generated per response (Ollama's `num_predict`).

Important: Tagnet AI depends heavily on function calling. The chosen model must support tools (for example llama3.2 or qwen3:4b). Models without tool support will chat but cannot look up any Tagnet data. Answer quality with small local models is noticeably below Azure OpenAI's hosted models.

Authentication

Tagnet AI supports two authentication methods for connecting to Azure OpenAI. Choose based on your deployment type.

Managed Identity (Hosted / Cloud Deployments)

Best for Azure-hosted deployments (Tagnet Cloud). No secrets to manage.

Leave AzureOpenAI:ApiKey empty
Assign the Cognitive Services OpenAI User role to the App Service's managed identity on the Azure OpenAI resource
Set AzureOpenAI:Endpoint to your resource URL

Tagnet AI uses DefaultAzureCredential, which automatically picks up the App Service managed identity.

API Key (On-Premises Deployments)

Best for Enterprise (on-prem) customers who have their own Azure subscription.

Create an Azure OpenAI resource in the customer's Azure subscription (see Setting Up Azure OpenAI below)
Copy the endpoint and one of the resource keys
Set both AzureOpenAI:Endpoint and AzureOpenAI:ApiKey in the production configuration

Security note: Store the API key in appsettings.Production.json (in the data directory, outside the web root) or via the AzureOpenAI__ApiKey environment variable. Never commit API keys to source control.

Deployment Type	Auth Method	Configuration
Tagnet Cloud (Azure App Service)	Managed Identity	`Endpoint` only
Tagnet Enterprise (on-premises)	API Key	`Endpoint` + `ApiKey`
Development / Testing	API Key	User secrets recommended

Setting Up Azure OpenAI

Follow these steps to create the Azure resources required for Tagnet AI.

1. Create an Azure AI Foundry Resource

In the Azure portal, search for Azure AI Foundry
Click Create
Select the customer's subscription and resource group
Choose a region with model availability (East US 2, Sweden Central, and West US typically have the best availability)
Choose a name following your naming convention (e.g., ai-tagnet-prod)
Complete the wizard and create the resource

2. Deploy a Model

Open the newly created resource
Go to Model deployments and click Deploy model
Select a model that offers function calling on the Responses API (for example gpt-5.4-nano, gpt-5-mini, or a GPT-6 deployment such as gpt-6-sol; see Choosing a Model)
Set the deployment name -- this must match the DeploymentName setting (default: gpt-5.4-nano)
Configure the tokens-per-minute (TPM) quota based on expected usage

3. Get the Endpoint and Key

In the resource overview, copy the Endpoint URL
Go to Keys and Endpoint and copy Key 1 (for API key auth)

4. Configure Tagnet

For hosted deployments, set the endpoint in the App Service configuration:

AzureOpenAI__Endpoint=https://ai-tagnet-prod.openai.azure.com/
AzureOpenAI__DeploymentName=gpt-5.4-nano

For on-premises deployments, use the Tagnet AI page in the Admin Console (choose Azure OpenAI, enter the endpoint, API key and deployment name, Test, then Save and restart). To do it by hand, add to appsettings.Production.json:

"AzureOpenAI": {
  "Endpoint": "https://ai-tagnet-prod.openai.azure.com/",
  "ApiKey": "your-key-here",
  "DeploymentName": "gpt-5.4-nano"
}

5. Configure Access (Managed Identity Only)

For hosted deployments using managed identity instead of an API key:

Open the Azure OpenAI resource in the portal
Go to Access control (IAM) > Add role assignment
Select the Cognitive Services OpenAI User role
Assign it to the App Service's system-assigned managed identity

Development Setup

For local development, use user secrets to avoid committing credentials:

dotnet user-secrets set "AzureOpenAI:Endpoint" "https://your-resource.openai.azure.com/" --project src/StratumGlobal.Tagnet.Api
dotnet user-secrets set "AzureOpenAI:ApiKey" "your-key-here" --project src/StratumGlobal.Tagnet.Api
dotnet user-secrets set "AzureOpenAI:DeploymentName" "gpt-5.4-nano" --project src/StratumGlobal.Tagnet.Api

What Tagnet AI Can Access

Tagnet AI has read access to the following data through function-calling plugins:

Plugin	Capabilities
Inventory	Search items, list the items at a location (or of a type or lifecycle state) with how long each has been there, list recent transactions into or out of a location by type and date range, get item details, transaction history, dashboard summaries, quantity breakdowns by type and location, transaction time series and daily rollups, the list of transaction types
Location	Browse location hierarchy, get location details and stats, list descendants
Catalog	List item types and get one type's setup (how instance IDs and tag IDs are assigned, its custom fields, item and inventory counts), list catalog items and get one item's setup and inventory totals, list custom fields and what they apply to, list sequence generators with their patterns and remaining values
Automation	List workflows with their trigger, actions, last run and the last 7 days of runs and failures; get one workflow's conditions, what each action does and when it runs, and its latest error; list every read point (device groups and readers not in a group) with which read signature is in use and where it was captured, and how many recent scan events did not match it. HTTP actions show only their endpoint or the host they call, never a URL, credential, header value or request body
Devices	List devices with their group, read point location, status, health and last check-in; get one device's model, firmware, network address, deployment state and last deployment error, antennas, health metrics and scan processing settings; list device groups with their devices and how they turn tag reads into scan events, plus whether each device has a read signature in use (its group's when grouped). Open offline and antenna alerts are included for users who can view alerts. Device credentials and reader configuration are never shown
Dashboard	User dashboard (items, movements, scans, scope breakdown), admin dashboard (device status, activity metrics), scan events and rollups
Documentation	Search help articles with ranked, natural-language friendly matching, retrieve article content or individual sections, list all available documentation
System Settings	View and update system configuration (admin only)

All data queries are automatically filtered by the current user's access scopes, and each function requires the same permission as the page that shows the equivalent data (for example, inventory functions require the "View inventory items and details" permission, catalog item functions "View items (product catalog)", workflow functions "View workflow definitions and executions", and device functions "View devices and device groups"). Open alerts appear in device results only for users who also have the "View operational alerts and their history" permission. The list of item types needs only the inventory permission, because the inventory functions use it to filter by type. System settings functions additionally require an administrator, regardless of permissions. Tagnet AI cannot see data the user is not authorized to view.

Write Operations (Admin Only)

Administrators can ask Tagnet AI to make limited configuration changes, such as updating system settings. Tagnet AI will always confirm the change with the user before applying it, and all AI-initiated changes are recorded in the audit trail with the user who requested the change and the update source (AI).

Non-admin users cannot trigger write operations. Tagnet AI checks the user's role automatically and will decline requests that require elevated permissions.

Usage Tracking

Tagnet logs every AI interaction, including token counts, model used, and which user sent the message. Administrators can view usage summaries on the About page under the "Tagnet AI Usage" section, which shows:

Total usage: all-time message count, token consumption, unique users, and credits
Monthly usage: the same metrics for the current calendar month

This data helps administrators monitor adoption and estimate costs without needing to check the Azure portal.

Transcript Logging (Optional)

For evaluating and tuning answer quality, Tagnet can record a transcript of every Tagnet AI turn: the question asked, the functions called (with their arguments), the response, and token counts. Each turn is appended as one JSON line to a daily file (ai-transcript-YYYYMMDD.jsonl).

Each line also records what produced the answer: the provider, the configured model, the sampling options in effect, why the model stopped, and how long the turn took. This keeps a collected set of transcripts meaningful after the configuration changes: without it, lines recorded before and after a model change cannot be told apart, and comparing two models on the same questions becomes impossible after the fact.

There is also a ServedModel field, for the name the provider reports for whatever answered. Azure OpenAI reports the deployment name (not the model version behind it) and Ollama repeats the configured name, so it normally matches the configured model. Group turns by the configured model rather than this one.

A FinishReason of length is worth watching for. It means the answer was cut off by the output token budget rather than finished, which otherwise looks like a complete (if odd) answer. If it appears often, raise MaxOutputTokens.

When a turn fails, the Error field says why, so failures can be grouped by cause from the transcript alone:

The error type and message (never a stack trace) when the provider call failed, for example an unreachable endpoint, a rejected key, or a request timeout.
cancelled when the user stopped the answer or left the page.
ended after a tool call with no answer when the model looked something up and then stopped without replying, which usually means it hit the MaxAutoInvokeAttempts limit.

Error is empty for a turn that answered.

Transcript logging is off by default because transcripts contain user-entered content. Enable it deliberately, for example on a test system during an evaluation period, and disable it afterward.

On-premises, use the Transcript logging section of the Tagnet AI page in the Admin Console: check Record a transcript of every Tagnet AI turn, optionally enter a full folder path, then click Save and restart. The section is there whatever provider is chosen. To configure it by hand, add to appsettings.Production.json:

"AiTranscriptLog": {
  "Enabled": true,
  "Directory": ""
}

Setting	Required	Default	Description
`AiTranscriptLog:Enabled`	No	`false`	Master switch. When false, nothing is captured.
`AiTranscriptLog:Directory`	No	`logs` under the data directory	Where transcript files are written. Use a full path, such as `D:\TagnetAiTranscripts`; the Tagnet service account needs write access to it.

Privacy note: Transcript files contain everything users type into the assistant and everything it answers. Treat them as user data: restrict access to the directory, and delete the files when the evaluation is done.

Cost Considerations

Azure OpenAI charges per token processed. Each Tagnet AI interaction uses tokens for:

Input tokens -- the system prompt, conversation history, and function call results
Output tokens -- the assistant's response text

Typical interactions use 1,000--5,000 total tokens. Complex queries requiring multiple function calls use more.

Conversation history includes the data earlier questions fetched, so a follow-up such as "which of those is oldest?" is answered from the results already in hand rather than by querying again. To keep input tokens bounded, the assistant replays at most the last 20 exchanges, and the data behind exchanges older than the last six is dropped from the replay (the assistant fetches it again if a later question needs it). Clearing the conversation starts over.

To monitor usage, check the Monitoring > Metrics blade on your Azure OpenAI resource in the Azure portal. Key metrics:

Processed Prompt Tokens -- input token consumption
Generated Completion Tokens -- output token consumption
Azure OpenAI Requests -- total request count

The MaxAutoInvokeAttempts setting (default: 10) limits how many function calls the model can chain per request, preventing runaway token usage from ambiguous prompts.

Limitations

Limited write access -- Tagnet AI can make limited configuration changes for admin users but cannot create, move, or delete inventory, locations, or other operational data
Per-tab conversations -- the conversation survives page reloads within the same browser tab, but resets when the tab is closed and does not follow the user across tabs or devices. After a reload, the assistant keeps the text of the conversation; the data fetched for earlier questions is kept only when it is small, and is otherwise fetched again when needed. On a reasoning model (GPT-6) that data rarely fits, because the model's reasoning travels with it, so a reload usually means the next question fetches again
No multi-user context -- Tagnet AI does not know about other users' activity unless it appears in shared data
Result limits -- Searches return the first 20 matches and activity feeds the most recent entries. The assistant is told when a result is partial, so it can say so and suggest a narrower question rather than treat a slice as the whole
Dashboard "today" is the UTC day -- Tagnet AI answers in your time zone, the same one the rest of Tagnet shows (detected from your browser, or set on your Profile page), and reads days you name, such as "yesterday" or "last week", as your local days. The exception is the dashboard summary's counts for today, which count the UTC day; the assistant says what local time that day began

Feature Overview​

Asking About the Current Page​

Enabling Tagnet AI​

Choosing a Model​

Local Models with Ollama​

Authentication​

Managed Identity (Hosted / Cloud Deployments)​

API Key (On-Premises Deployments)​

Setting Up Azure OpenAI​

1. Create an Azure AI Foundry Resource​

2. Deploy a Model​

3. Get the Endpoint and Key​

4. Configure Tagnet​

5. Configure Access (Managed Identity Only)​

Development Setup​

What Tagnet AI Can Access​

Write Operations (Admin Only)​

Usage Tracking​

Transcript Logging (Optional)​

Cost Considerations​

Limitations​