---
title: "Chatting with Halon"
description: "Ask Halon questions and have it do work for you, from the dashboard's Chat page or by mentioning @Firefight in an incident channel."
canonical: https://firefight.app/docs/ai/chat
---

# Chatting with Halon

A chat is a conversation with [Halon](https://firefight.app/docs/ai/halon.md) where you ask a question or ask it to do something, and it does the work the question needs before it answers. You chat with Halon on the **Chat** page of the dashboard, or by mentioning @Firefight in an active incident's channel in Slack.

## In the dashboard

Open **Chat** under Halon in the sidebar. A new chat asks **What do you want to know?** above the message box. Below it are example questions to start from:

- **Which incidents are open?**
- **What changed before an incident?**
- **Has this happened before?**
- **Set up Firefight**, shown first to anyone who may change the workspace's settings

Choosing one puts it in the message box for you to finish. Type `@` to pick one of the newest active incidents, or keep typing to search for one. Press Enter to send, and Shift+Enter for a new line. You can also attach files to a message, see [Giving Halon a file](https://firefight.app/docs/ai/files.md).

The chat is named after your first question, and only you see your own chats. Asking needs **Investigations** with create, which every member has unless an admin took it away. See [Permissions](https://firefight.app/docs/gateway/permissions#asking-halon).

### While Halon works

While Halon works, the chat shows its turn in the order it happened: each step it takes, and the short notes it writes as it goes, such as "The deploy went out at 14:02, so I am reading the logs from then", as quieter lines among the steps. While it is still working, a finished stretch of several steps folds into one line saying what it did, such as **Looked at 12 things · GitHub**. Once it is done, the whole stretch folds away under a line such as **Worked for 12s · 4 steps**. Choose a folded line to open it again. A question Halon asks you, and its answer, stay in view and never fold.

Each step names what Halon did. A step through one of your connections names the call and the connection, such as **Search logs · Production (Northflank)**, so you can tell which account it reached. Next to it is what told that step apart from the others, such as the name it looked up. Choose a step to see everything it was given.

| Mark | Meaning |
|---|---|
| Running | Halon is waiting on this step |
| Done | The step finished |
| Failed | The step was refused for lack of permission or returned an error. Halon still reads why |
| Not found | The provider answered that what Halon asked about is not there. That is an answer, not a failure |
| Refused | One of Firefight's own rules stopped the step, such as a protected branch. Halon tells you the rule and does not look for another way around it |
| Waiting for you | The step needs your confirmation before it runs |
| Cancelled | The step did not run |
| Stopped | You stopped the answer while the step ran or before it started |

A step that failed or waits on you keeps the list open, since it needs a look.

#### A code fix as it happens

When Halon writes a code fix in a chat, the **Fix code** step shows what its agent is doing while it works, which can take several minutes. Under the step you see:

- The last few things the agent did, such as **Read config/database.yml**, **Searched for 'pool'**, **Edited config/routes.rb** or **Ran bin/rails test test/pool_test.rb**, with **passed** or **failed** after a test run. The newest one is marked as where the agent is now
- How long it has been working, and the files it has changed so far
- **Show 12 steps before these**, which opens the earlier ones

The agent's notes to itself show as a line starting with **Thinking**. A step names files and commands only, never what a file holds, and anything that looks like a password or key is hidden.

The agent starts from what you asked in your own words, including anything you corrected later in the chat, and from what Halon already read, such as a log search or a workflow file. While it works it can read your connected tools the way Halon does, as you, such as logs, deploys, CI runs, the resource map, past incidents and each provider's own guides, so a line such as **Read with github_list_workflows** is the agent checking something for itself. It never changes anything through them, and each read is in [Activity](https://firefight.app/docs/gateway/activity.md) under **Coding agent**. It also reads the documentation Firefight keeps for your connected providers before it searches the web.

##### When the agent asks you something

When what to do is a choice only you can make, the agent asks. The step shows **Waiting for an answer**, and under it **The coding agent asks** with the question, explained with an example and what happens today, then two to four options. Each option says what choosing it leads to, and the one the agent recommends is marked **Recommended** with why. The agent recommends what matches how your code already behaves and what you asked for. Click an option to answer, or write your own answer under **Something else** and choose **Send answer**. A message confirms it reached the agent, which carries on with it. Halon answers first when what you said or what it read settles the question, and the step then shows **Halon chose:** or **Halon answered:**.

Only the person who asked for the change can answer, since it runs as you. When nobody answers before the time the step shows, five minutes after the question, the agent goes with the option it recommended, and the step says so. In a Slack thread the question is its own message with a button for each option and **Something else**, which opens a form, and it says who can answer and by when.

An answer can still change while the agent writes the change, whether Halon gave it, you gave it or the agent went with its recommendation. Choose **Change answer** under the question, pick another option or write your own answer, and choose **Submit**. A message confirms the new answer reached the agent, and the question shows **Changed to** with the new answer and who changed it. The agent is told the new answer replaces the earlier one. When it had already finished, the change goes back to it with the new answer before Halon reviews it. In a Slack thread the answered question keeps a **Change answer** button, which opens a form with the options and a box for your own words. Only the person who asked for the change can change the answer, and everyone else sees **Change answer** greyed out with who can. Once the change has finished it can no longer change. If you change it just as the change is pushed, nothing is pushed and the step says so, so ask Halon again.

##### Before the pull request opens

The agent writes the change first, then checks its own work as far as it can. A test it cannot run there, such as one that needs a database, never stops the change. The pull request still opens with that test listed under **Could not run here** with the reason, and your repository's own CI runs it. A repository with no CI is said to have none in the pull request and in Halon's answer, so your review decides (see [Repository setup](https://firefight.app/docs/api/integrations#repository-setup)). Firefight then checks the files the pull request changes with what your repository has, such as its linter, its type checker, the tests the change touched and the tests for the files it changed, and a workflow linter for a GitHub Actions file. A check that cannot run there is listed as could not run with the reason, never as a problem with the change. Halon then reviews the change against what you asked, and against what the evidence and the provider's documentation say, such as a rule an error message states. Only the pull request's own change is checked and reviewed, even after the agent merges the base branch in to resolve a conflict. A change the review finds wrong goes back to the agent once with what the review found. When it is still wrong, nothing is opened, and the step and Halon's answer say what the review found.

Once the pull request is open, the step sums up Halon's review, the files it changed with the lines added and removed, the tests it ran and whether each passed the last time, the checks and how each went, and **Open the pull request**. **Verified** says what the review checked and against what, **Found in review** lists problems worth a look, and **Open questions** lists only what could not be checked and matters, such as how another system reads a value the change sends. When a change is too large to review whole, **Not reviewed** names the files that were left out. The files you named are always reviewed whole.

The pull request's description says the same, written only from the change, its checks and Halon's review, so nothing Halon read from your live systems or told the coding agent ends up in it. When Halon adds to a pull request it opened, it writes the description again for the whole change as it now stands. When Halon changes a pull request's title, description or labels, or comments on it, it tells you what GitHub now shows.

The pull request's title says what the change does. Its description starts with what the change does and why, then the same lists, then the files it changes. When Halon adds to a pull request that is already open, its comment says what this update changed. Halon tells you the same in the chat, in a few plain sentences. **Show the steps** lists everything it did. When you asked Halon to add the fix to a pull request that is already open, the step ends with **Added to the pull request** and the same summary. When the agent stops without a change, the step keeps its last few steps and says why.

The agent always starts from the newest commit of the branch the pull request goes into, so it does not conflict with something merged minutes earlier. When it fixes a pull request that conflicts with its base, it merges the base in and resolves the conflict, so the pull request shows a merge commit. The agent never holds your GitHub token and can push only to its own branch. A change that touches your repository's [paths Halon may not change](https://firefight.app/docs/api/integrations#paths-halon-may-not-change) is never opened. Halon's answer ends with what GitHub says about the pull request, such as whether it can merge and which checks fail, and Halon never says a conflict is resolved unless GitHub does.

##### When a fix reaches its spending limit

Each fix has a spending limit for the AI it uses, $2 unless an admin set another (see [Settings](https://firefight.app/docs/ai/halon#settings)). When a fix reaches it before finishing, it pauses rather than failing. Its work so far is saved on a branch of its own, such as **halon/fix-1a2b3c4d**, and nothing is opened or changed on a pull request. A card appears in the chat under Halon's answer, **This fix has reached its spending limit before finishing. Continue?**, with what the fix spent, what **Continue** gives it, and **Continue** and **Stop**. The step shows the same question with both buttons, and in a Slack thread it is its own message. Only the person who asked for the change can choose, since it runs as you, and approval rules apply as usual. Everyone else sees who can.

**Continue** is how a fix gets more to spend. It gives the fix the same limit again, the limit it paused with, and carries on where it stopped. The chat shows the fix's progress again at once. Within about 15 minutes of pausing it picks up exactly where it was. After that it starts again from the saved branch, with what you asked, your answers to its questions and what it already changed. **Stop** asks you to confirm first, since it deletes the saved branch. Once you choose, the card says who chose what.

When you ask Halon to raise the limit, or why a fix stopped, it points you to **Continue** on the card.

##### After the pull request opens

Halon follows every pull request it opens until it is merged or closed. When one conflicts with its base branch, a check fails, or a reviewer asks for changes, a card appears in the chat you asked from, such as **PR #689 in acme/web needs attention**, with why, what fixing it will do, **Fix it** and **Open the pull request**. In a Slack thread the same message is posted in the thread. For a chat in the dashboard it comes to you as a direct message from Firefight, with **Open the chat**.

Nothing on the branch changes until you choose **Fix it**. The fix runs as you, with your permissions and any approval rules, and only the person who asked for the change can press it. Halon then says in the chat how it went. When newer problems come in, the card says it was replaced by a new one. When the problems go away on their own, the card says GitHub no longer shows them.

:::tip
For notices within seconds, an owner of your GitHub account can let Firefight's GitHub App receive pull request, review, check and status events. Without them, Halon checks each pull request every few minutes.
:::

Leaving the page loses nothing. Open the chat again, or from another device, and the step shows the same. In a Slack thread the step shows how far the agent got in numbers only, such as **Writing the change: 14 steps, 2 files changed so far**, updated every few seconds, and how it ended once it is done. It never names the files the agent read or the commands it ran there.

### Adding to a question

You can keep typing while Halon works. The message box says **Add something while Halon works**. Whatever you send shows under the answer with **Halon reads this at its next step**, and joins the answer Halon is already working on rather than waiting for it to finish. Your newest message decides what Halon checks next, so use it to steer, such as "skip the database, it is the worker".

### Stopping an answer

While Halon works and the message box is empty, the send button becomes **Stop**. Choose it and Halon stops at once, even in the middle of a long step such as a command in its terminal or a code fix, and ends the answer with **Stopped.** The message box says **Stopping** until it has. What Halon already did stays in the chat, a step it was running shows **Stopped**, nothing it had not started runs, and your next question starts clean.

### Choosing the model

The message box shows which AI model Halon answers with, such as **Claude Sonnet 5.5**. A new chat starts on the main model of your workspace's [AI account](https://firefight.app/docs/ai/ai-accounts#main-and-quick-models), marked **Default**. Choose the model's name to see the others you can switch to, each with a few words on what it is for, such as **Everyday questions**, **Investigations and tricky problems** or **Hardest problems and production changes, costs more**. Everyday models come first. When there is only one model to run, the message box shows none.

Pick a model before your first question and the new chat starts on it. Pick one in an open chat and a message confirms it, such as **This chat now uses Claude Opus 5.5.** The choice belongs to that chat and applies from your next question, so an answer Halon is already writing finishes on the model it started with. Choosing the default again puts the chat back on your workspace's main model, and it follows that model if an admin changes it.

| Account's provider | Models you can switch to |
|---|---|
| OpenRouter | Claude Haiku 5.5, GLM-5.3 Flash, GLM-5.2, DeepSeek V4.1 Flash, DeepSeek V4 Pro, Claude Sonnet 5.5, GLM-5.3, GPT-6 Sol, Claude Opus 5.5 |
| Anthropic | Claude Haiku 5.5, Claude Sonnet 5.5, Claude Opus 5.5 |
| OpenAI | GPT-6 Luna, GPT-6 Sol, GPT-6 Astra |
| Google Gemini | Gemini 3.8 Flash, Gemini 3.1 Pro |
| Google Vertex AI | Claude Haiku 5.5, Gemini 3.8 Flash, Claude Sonnet 5.5, Gemini 3.1 Pro, Claude Opus 5.5 |
| Amazon Bedrock | Claude Haiku 5.5, Claude Sonnet 5.5, GPT-6 Sol, Claude Opus 5.5 |
| DeepSeek | DeepSeek V4.1 Flash, DeepSeek V4 Pro |
| Mistral | Mistral Medium, Mistral Large 4 |
| xAI | Grok 4.3, Grok 4.7 |

The main model is always in the list, along with any of these your provider serves. Azure AI Foundry, Ollama and GPUStack run models you name yourself, so they offer only the main model.

Each answer names the model that wrote it in small text underneath, so you can compare them. When Halon moved to another account part way through an answer, both are named.

When the model you picked stops answering, or its account runs out of credit, Halon carries on with another model for that answer and says so in one line, such as **Claude Opus 5.5 is not answering, so I switched to Claude Haiku 5.5 for this reply.** Your next question starts on your pick again.

The choice changes only who answers you in that chat. The same account pays for it, or your [Firefight credits](https://firefight.app/docs/ai/ai-accounts#firefight-credits) when Halon runs on those. Investigations Halon starts, code fixes, helpers and quick work such as summaries keep their own models, and a chat in Slack always runs on the workspace's main model.

### Being told later

Ask Halon to tell you when something finishes, such as a CI run or a deploy, and it keeps watching after its answer and reports back in the chat and in a Slack direct message. While a watch is going, it is pinned above the message box under **Watching**, however far the chat scrolls. See [Halon watching for you](https://firefight.app/docs/ai/watching.md).

### What Halon says before and after it acts

When a request reaches more than one system, or could mean more than one thing, Halon first says its plan back as short numbered steps naming each system, such as "1. Start the Release workflow in acme/web. 2. Follow the release workflow it starts on Northflank. 3. Tell you when both finish." It acts once you agree. A request that is clear and touches one system it just does.

When Halon said it cannot do something and you tell it that it can, or that you have since connected, granted or switched something on, it checks again before it answers. It then says what it found, such as "You were right, that is in the Code tools", or what still blocks it and what would unblock it.

Halon looks up what it can find itself rather than asking you. "The latest main" means it reads which commit main is at.

An answer about a problem, or about work that just finished, ends with the most useful next step and an offer to take it, such as "Next I would read the error the webhook returned, shall I?" Halon changes nothing until you say yes, and you can say no or suggest something else. It recommends a fix only when something it read shows the cause. When the cause is still unknown, the next step it offers is the check that would show it.

### What an answer can hold

Answers are formatted text, with tables and code blocks. Code is coloured for its language, such as Ruby, TypeScript, YAML, SQL or a shell command, and a long line scrolls inside its block. **Copy code** on a code block copies it. A link to another site opens in a new tab, so following a source never loses the chat.

Some results are drawn rather than written.

| Card | When it appears |
|---|---|
| Charts | Halon read metrics from a connected tool. Halon places each chart in its answer right after the sentence about it, and charts it wants you to compare sit side by side. A chart it placed nowhere follows the answer. Each chart shows its title, unit and time range, and **Open the live chart** when the provider has one. A chart only ever shows with the answer that drew it |
| Integrations | Halon showed you a kind of integration, such as where alerts come from. Each provider shows whether it is **Connected**, **Needs attention**, **Turned off** or **Not connected**, with **Connect**, **Reconnect** or **Manage**. **See all integrations** opens the Integrations page |
| An investigation | Halon started an investigation for you. See [Investigations](https://firefight.app/docs/ai/investigations.md) |

Connecting from an integrations card opens the same dialog as the Integrations page, and coming back to the chat shows the provider connected. A person who cannot connect integrations sees **An admin can connect this** instead.

A long chat can fill the space the AI model has to work in. When Halon makes room, a quiet line says **Shortened its working notes to make room**. See [AI data handling](https://firefight.app/docs/ai/data-handling.md).

### Confirming a change

Halon asks before a risky change, or one an approval rule covers. A safe change runs without asking and shows in the chat instead. See [Changes without asking](https://firefight.app/docs/ai/changes-without-asking.md). The question appears at the foot of the chat as one card, saying what Halon wants to do, such as **Halon wants to: restart web**, with one line under it, **Approve**, **Cancel** and **Details**. Where the change may be allowed for the chat, an **Allow for the rest of this chat** tick sits above the buttons. When Halon asks about several changes at once, each is its own question in the same card. Answer each one, and while others still wait, **Change** reopens an answer you already gave. Halon carries on once every question is answered, the card shows **Sent**, and a message says how each change now stands, such as "Restart web is approved." What each choice does, and which changes ask, is in [What Halon can do](https://firefight.app/docs/ai/tools-and-approvals#asking-before-a-change).

To read the chat around a question first, close the card with its cross, and **Open approval** brings it back.

When a change needs someone else's approval, Halon says it is waiting and carries on. A card in the chat shows who may approve it, and once it is approved the change runs and the card follows it until it is done. See [Waiting for someone else's approval](https://firefight.app/docs/ai/tools-and-approvals#waiting-for-someone-elses-approval).

### Entering a secret

Some changes need a value Halon should never see, such as a secret for a GitHub Actions workflow. Halon never asks you to type it in the chat. It names the secret, and a card appears under its answer, such as **Enter the value for DEPLOY_HOOK in acme/web**. Click **Enter value** and type it in the field that opens. Firefight sends it straight to the provider and keeps no copy, and a message confirms it once it is set. The card then says who set it and when.

The field stays open for an hour and only the person who asked can fill it, since the change runs as them. Anyone else sees why the button is unavailable. When the value already exists elsewhere, such as a webhook address Halon just created in Northflank, Halon passes it across itself and the card is not needed.

A webhook address Halon creates works like a password, so Halon never shows it in its answer. A card under the step offers **Reveal**, which reads the address from the provider and shows it with a copy button. Only the person who asked can reveal it.

A Firefight token works the same way. When Halon creates an agent or an API key for you, or rotates an agent's token, it never sees the token. A card under the step, named after the token, offers **Show token**, which shows it once with a copy button. Firefight keeps no copy, so issue a new one if it is lost. Only the person who asked can show it.

In a Slack thread, Halon posts the same card with **Enter the value in Firefight** or **Reveal in Firefight**, which opens the chat in the dashboard. You never type a secret into Slack.

### Running a saved runbook

Ask for a saved runbook by name, such as "release Firefight", and Halon runs its steps for you. It says what it will do and asks for anything it needs, then the confirmation lists every step with the exact tool and arguments it will use. Confirm it and the steps run one after another as you. If a step is refused, waits for an approval or fails, the run stops there and Halon says which step and why. To save a multi-step task you just did, say "remember this as" and a name. See [Runbooks Halon can run](https://firefight.app/docs/incidents/runbooks#runbooks-halon-can-run).

### Setting up your workspace

Choose **Set up Firefight** on a new chat, or ask Halon to help you set up Firefight. It reads what is already configured, then offers the most useful missing piece first, starting with where your alerts come from, then your code, then the rest. It goes one step at a time and changes a setting only once you agree.

Halon never connects an integration for you. It shows you the integrations of the kind you want and you connect from that card. It never asks for a key, token or password, and one pasted into the chat is not used. Halon tells you so and points you to the card.

### Managing your chats

Your chats are listed beside the conversation, newest first, under **Pinned**, **Today**, **Yesterday**, **Previous 7 days**, **Previous 30 days** and **Older**. Archived chats are folded away at the end under **Archived**, with their count. **New chat** starts another. Chats you had with Halon in your Slack direct messages are listed too, marked **Slack**. Opening one shows the whole chat, with **Open in Slack** in place of the message box, since Halon answers it there.

Open a chat's menu for these actions:

| Action | What happens |
|---|---|
| **Rename** | Gives the chat a new name |
| **Pin** / **Unpin** | Keeps the chat at the top of the list |
| **Archive** / **Unarchive** | Moves the chat into the folded **Archived** section, or back |
| **Delete** | Asks first, then deletes the chat with its questions, answers and files for good |

**Search chats**, or Ctrl+K (Cmd+K on a Mac), finds a chat by its name or its latest message. **Hide chats** folds the list away to give the conversation the whole width, and **Show chats** brings it back.

### On a phone

On a narrow screen the page shows one thing at a time, either your chats or the open chat. **All chats** at the top of a chat goes back to the list.

## In Slack

Mention @Firefight in the channel of an active incident with your question, for example `@Firefight what changed in checkout in the last hour?`. Halon knows which incident the channel is for and its status, and it reads the instructions and memories that apply to the incident's services.

Firefight adds an eyes reaction to your message while Halon works on it, then answers in a thread under it. Once the answer is in, or Halon asks you to confirm something, the eyes give way to a check mark. Mention it inside a thread and the answer goes in that thread. While Halon works, Slack shows that Firefight is working and lists each step in the reply as it runs, in plain words such as **Checked recent deploys** or **Read the code**, then the answer appears. When Slack cannot show the steps, the whole answer is posted once it is ready. A long answer is never cut short. It carries on into more messages, and every link in it opens.

When Firefight cannot answer you, for example because you do not have permission, it tells you in the thread with a note only you can see, and keeps a copy in your direct messages so the reason is still there after you reload.

Charts are posted in the thread after the answer as images, each with a line saying what it shows and a link to the live chart when the provider has one. Only the charts drawn for that answer are posted. At most six are posted under one answer, followed by a note saying how many more there were. An integrations card is posted as a list with a button per provider that opens the dashboard to connect it.

### Following up in a thread

Each thread is one chat. Mention @Firefight again in the same thread and Halon carries on from what was said there, rather than starting over. Anyone in the thread can ask, and each question acts as whoever mentioned Firefight that time. Halon answers only messages that mention it.

Mentioning Firefight in the thread of an investigation that is still running adds what you wrote to the investigation instead. See [Investigations](https://firefight.app/docs/ai/investigations.md).

### One question at a time

Halon answers one question at a time in a thread. If you mention it again while it is still answering you, your message joins that answer at its next step. If someone else mentions it meanwhile, their question waits and is answered after, as them.

### Stopping and confirming in Slack

Use Slack's own stop button on Firefight's reply to stop an answer. The reply ends with **Stopped.**

When Halon needs a confirmation, it posts "Halon wants to:" and the change in the thread, with one line on what it does or why, and **Approve**, **Cancel** and **Details**, plus **Allow for this chat** where it may be allowed. Anyone with **Investigations** create can answer, and the change runs as whoever pressed the button. Once answered, the message says who approved it and follows the change until it says it is done, failed or was cancelled. If someone asks Halon something else before the question is answered, the question is withdrawn and the message says so.

### Outside incident channels

In any other channel, a mention whose first word is investigate starts an investigation, such as `@Firefight investigate checkout returns 500 since 14:00`. See [Investigations](https://firefight.app/docs/ai/investigations.md). Any other mention outside an active incident's channel, including in the channel of an incident that has ended, gets no answer. For questions that are not about an active incident, write to Firefight in your direct messages, or use **Chat** in the dashboard.

## In your direct messages

Write to Firefight in your direct messages with the app, as you would on the **Chat** page. Halon answers as a reply under your message, with everything a thread in a channel has: its steps as it works, confirmations, approvals, plans, watches, files you attach and Slack's stop button. Each question acts as you, with the permissions you have everywhere else.

A new message carries on the chat you had with Halon while it had a word in the last day. After a day of quiet, a new message starts a new chat. A reply in the thread of an earlier answer carries on that chat however long it has been. Reply under a message Halon sent you on its own, such as a watch update or an approval it waits on, and Halon reads that message first, so "why did that fail?" needs no more words.

These chats are listed on the **Chat** page with your others, marked **Slack**. Someone from outside your workspace who writes to the app is told Halon only answers people in this workspace.

## Who Halon acts as

Every question acts as the person who asked it, with the same permissions they have in the dashboard. Halon can do for an admin what an admin can do, and it is refused where a member would be refused. When something is refused, Halon tells you plainly and who can do it instead. Every call it makes is recorded in **Activity** under your name. See [What Halon can do](https://firefight.app/docs/ai/tools-and-approvals#who-halon-acts-as).

## When Halon cannot answer

When Halon cannot finish, it says so in place of an answer, in the dashboard, in the Slack thread and to an agent asking over MCP.

| You see | Why |
|---|---|
| Halon couldn't reach its AI just now. The team has been told. | The AI Halon runs on refused the call, and the people running Firefight have been told. Your question stays in the chat, so ask again later |
| I could not finish that one. Ask me something narrower, or start an investigation. | The question needed more work than one answer allows. Each new question gets a fresh allowance |
| Something went wrong on my side, so I did not finish that one. Ask me again. | The AI model failed to answer |
| The model sent back a reply I could not read, so I did not finish that one. | The model answered twice in a form Halon could not read. In a chat with more than one model it adds that you can ask again or pick another model |
| I was interrupted before I finished. Ask me again. | Firefight restarted while Halon worked, and the answer could not safely be picked up again, such as when it was making a change |
| The AI model is not fully set up yet. An admin needs to finish setting it up. | The AI model is not set up. In Slack only you see this. In the dashboard you are sent back to the Incidents page with it |
| You don't have permission to do that in Firefight (investigations.create). Ask a workspace admin to grant you investigations access under Gateway, Permissions. | An admin took asking Halon away from you. In Slack only you see this. In the dashboard the message says you don't have permission to change investigations, and your question is not sent |

If you run Firefight yourself and its AI account runs out, the message is "Halon couldn't reach its AI just now." It adds that the team has been told only once your install sends alerts to a Slack webhook. When your workspace runs Halon on its own [AI accounts](https://firefight.app/docs/ai/ai-accounts.md), the message starts "Halon cannot answer right now because" and names the problem (no AI account set up, an account out of credit or a refused key), then says an admin can fix it under Settings, Workspace, AI accounts. When this month's [included AI](https://firefight.app/docs/ai/ai-accounts#included-ai) and your [Firefight credits](https://firefight.app/docs/ai/ai-accounts#firefight-credits) are used up, it says what ran out and where an admin tops up.