AI Services

Overview

Use the AI Services screen in the Admin Console to control which generative AI models are used in your Appian applications. As AI providers release new and more powerful models, this screen allows you to adopt them in a secure and controlled way to benefit from the latest improvements in performance and accuracy.

Use the Appian tab to manage the generative AI models provided by Appian. When you select Appian as the cloud provider, the Appian tab includes Claude models, Amazon Nova 2 Lite, and GPT models (GPT 5.4 and GPT 5.5).

How it works

Enabling a model on the Appian tab makes it available to power various AI capabilities in your environment. For some newer models, you must also select an inference profile. For Appian sites in a US region, the US inference profile is selected by default.

An inference profile is a setting that controls which geographic regions can process your AI data. Unlike older settings that were limited to a single region, inference profiles allow processing in multiple pre-defined regions. This provides greater flexibility for data governance while ensuring access to the most powerful models.

Model card status tags

Model cards display status tags to help you quickly identify the state of each model:

• ENABLED: The model card displays this tag when an inference profile is selected for the model, indicating it is active.
• DISABLED: The model card displays this tag when no inference profile is selected. The model card is grayed out to show it is inactive.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Inference profiles: Control where your AI data is processed

Inference profiles define the regions through which data may move when using the model. Unlike older cross-region settings that limited you to a single region, inference profiles offer more flexibility by allowing processing in multiple pre-defined AWS regions.

Inference profiles are required for some generative AI models, particularly newer models. System administrators select the appropriate inference profile for your environment in the Appian Administration Console. When you choose a profile, the model card lists the supported regions so you can confirm where data will be processed before saving your chosen profile.

After you select an inference profile, review the supported regions on the model card for that profile. Confirm where data could be processed before saving your selection. For details about regional availability and inference profile concepts, see Regional Availability.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Considerations when enabling AI models

Enabling a model on the Appian tab changes which models are available for your AI capabilities. Before you enable a model, keep these considerations in mind:

• System administrators can enable models and and select inference profiles in the Admin Console. For sites in a US region, a US inference profile is enabled by default.
• For FedRAMP sites, Appian AI models are automatically configured based on your service agreements and cannot be selected in the Admin Console.
• If you select an inference profile that doesn't match your site's region, Appian automatically uses one of the regions defined in that profile to connect to the generative AI service. This does not cause an error.
• Disabling a model by selecting None for its inference profile will impact any features that rely on that model.

Impact on AI capabilities

The following AI capabilities will automatically use the latest available models in the environment:

• AI agents
• CMS Data Type Recommendation
• Composer
• Data Fabric Chat
• Process Insights
• Sample Data Generation
• Test Case Generation

Impact on generative AI skills

Generative AI skills behave differently than other AI capabilities when you change models.

• New skills: By default, new AI skills are created with the latest available model in the environment. However, you can select any available model instead.
• Existing skills: Your existing AI skills will not automatically update. To use the new model, you will see a banner in the prompt builder with instructions to perform the update. If a new model is not selected, existing skills will continue to use the previously available models.

AI skills automatically use the highest-priority supported model available in your region, including any model you explicitly select through an inference profile.

• If that model is deprecated, the AI skill uses the next supported model.
• If the selected model is unavailable during invocation and the provider is Appian, Appian executes a fallback to the next available model.
• If no supported models are available, the AI skill returns an error.

Manage AI model providers

You can configure which AI providers powers Appian's generative AI features. By default, Appian uses its own infrastructure. However, you can configure your own AWS account to provide greater control over security, compliance, and cloud resource management.

How model providers work

Configuring a provider allows Appian features to use large language models (LLMs) from your own AWS account. This applies only to LLM inference for generative AI features. Other AI capabilities like Advanced IDP continue to use Appian's infrastructure.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Default model behavior

When an admin sets a provider as the default provider, Appian uses it for AI features where a developer has not explicitly chosen a specific model or provider. This means:

• Features without model selection: AI capabilities like AI agents, Composer, and Data Fabric Chat automatically use the configured model provider.
• Features with model selection: Developers can select from models offered by all enabled providers.

Security and connectivity

When you configure your own AWS account, Appian uses a secure architecture to manage credentials and validate connectivity to your resources.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Credential protection

Appian handles your AWS credentials with multiple layers of security to ensure they are never exposed:

• Secure transmission: All credentials are transmitted over HTTPS.
• Masked storage: The Access Key and Secret Access Key are masked after saving and are never displayed again in the Admin Console.
• No logging: Sensitive credentials are never written to server logs.

Connectivity validation

Before saving your configuration, the TEST CONNECTION feature performs a real-time validation against your AWS account. This confirms:

• Authentication: Your Access ID and Secret Access Key are valid for the selected region.
• Permissions: Your IAM user has the required bedrock:InvokeModel permissions.

Prerequisite: AWS IAM permissions

Before configuring your AWS account, you must create an IAM (Identity and Access Management) user with the required permissions. Ensure your AWS administrator sets up this user before you configure your AWS account in Appian.

Your IAM policy must include at least the following permissions:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "bedrock:InvokeModelWithResponseStream",
                "bedrock:InvokeModel",
                "bedrock:GetFoundationModel"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/*",
                "arn:aws:bedrock:*:{YOUR_ACCOUNT_ID}:inference-profile/*"
            ],
            "Sid": "BedrockPermissions"
        },
        {
            "Action": [
                "bedrock:ListInferenceProfiles",
                "bedrock:ListFoundationModels"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "BedrockListPermissions"
        },
        {
            "Action": [
                "bedrock-mantle:CreateInference",
                "bedrock-mantle:CallWithBearerToken"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "BedrockMantlePermissions"
        }
    ]
}

Enable models on AWS Marketplace

Some Amazon Bedrock models are offered through AWS Marketplace and require a subscription before they can be used. The first time Appian calls one of these models on your AWS account, AWS attempts to enable the model automatically. This attempt fails if the IAM policy does not have the required permissions to subscribe. Use one of the following approaches to enable the model. If you use the IAM policy approach, it also grants the permissions needed for automatic enablement on first use.

Manual approach

An administrator on your AWS account can enable the model directly in the AWS Management Console. For details, see Simplified Amazon Bedrock Model Access on the AWS Security Blog.

Programmatic approach

To avoid manual steps, add the following statement to the Statement array in your IAM policy. This allows Bedrock to subscribe to Marketplace models automatically on first use:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
{
    "Sid": "AllowMarketplaceSubscription",
    "Effect": "Allow",
    "Action": [
        "aws-marketplace:ViewSubscriptions",
        "aws-marketplace:Subscribe"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:CalledViaLast": "bedrock.amazonaws.com"
        }
    }
}

Rate limits and capacity planning

When you use your own AWS account, you're responsible for managing the rate limits on your Bedrock resources. Ensure that the rate limits on your AWS account support the volume of AI requests you expect to process in Appian. If your rate limits are too low, AI features may fail or experience delays during high-usage periods.

To check and adjust your rate limits, see the AWS Bedrock documentation on quotas.

Configure your AWS account

To use your own AWS account as the model provider:

1. In the Appian Admin Console, go to AI Services.
2. Select Amazon Web Services from the model provider dropdown.
3. Enter the following credentials:
   • Access ID: Your AWS access key identifier.
   • Secret Access Key: Your AWS secret access key. This value is masked after saving and doesn't display again.
4. Select the AWS Region where your resources are located. This is the source region that Appian will use when calling Bedrock.
5. Click TEST CONNECTION to validate your credentials and verify sufficient permissions.
   • Successful test: A green confirmation appears with the message "Test connection successful." This confirms your credentials are valid and have the required permissions.
   • Failed test: An error message appears indicating the issue. Common failures include:
     • Invalid credentials: Verify your Access ID and Secret Access Key are correct.
     • Insufficient permissions: Ensure your IAM policy includes the required Bedrock permissions.
     • Region mismatch: Confirm the selected region matches where your AWS Bedrock resources are configured.
6. Click SAVE CHANGES to apply your configuration.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Revert to the Appian provider

You can switch between Appian's default provider and your own AWS account at any time.

To revert to Appian's provider:

1. In the Appian Admin Console, go to AI Services.
2. Select Appian from the model provider dropdown.
3. From the context menu, select Set as Default Provider
   
4. Click SAVE CHANGES.

Verify AI features after switching default providers

After switching default providers, test your AI capabilities to ensure they work as expected:

1. Test an AI capability like Composer or data fabric chat to confirm it generates responses.
2. If you have existing generative AI skills, test them in your applications to verify they execute successfully.
3. Check the application server logs for any authentication or connection errors related to AI features.

If AI features fail after switching providers, verify that the new provider has the necessary models enabled and that your credentials (for AWS accounts) are configured correctly.

Deploy AI model provider configurations

When you deploy applications between environments that use your own AWS accounts as the AI model provider, you need to configure credentials for the target environment.

Export behavior

For security reasons, AWS credentials are not included when you export Admin Console settings. The Access Key and Secret Access Key are never exported from the source environment.

Import behavior

When importing an Admin Console settings file that includes AWS credentials, you must provide valid AWS credentials again in an import customization file. AWS credentials—including the default provider, keys, and inference profiles—are exported as a single unit. Because of this, you must include valid credentials in your import customization file even if you only modified the inference profiles.

The import customization file must contain:

• AWS Access Key ID
• AWS Secret Access Key
• AWS Region

If you want to maintain the existing AWS credentials in your target environment without modification, you can exclude them during the export process.

To prevent overwriting credentials:

1. In the export dialog, deselect AWS Credentials.
2. Complete the export.

When you exclude this option, the import process will not change any existing AWS configuration in the target environment.

For detailed instructions on setting up these files, see Managing Import Customization Files.

Manage inference profiles

To enable or disable a model by selecting an inference profile:

1. In the Appian Admin Console, go to AI Services.
2. On the Appian tab, locate the model card for the model you want to configure.
3. In the Inference Profile dropdown, select a profile to enable the model, or select None to disable it.
   • If you select None, review the warning in the confirmation message that disabling the model will impact application features that rely on it. Confirm your choice.
     
4. After you select an inference profile, review the supported regions on the model card for that profile. Confirm where data could be processed.
5. Click SAVE CHANGES to apply your changes.

Feedback