AI in Row Zero

Row Zero’s AI assistant can read and analyze your data, create formulas and pivot tables, generate visualizations, and perform complex calculations, all within your workbook. AI-produced analysis is fully auditable and editable, so you can easily investigate the underlying data and tweak the analysis.

Row Zero AI is currently available to enterprise customers, using a “bring-your-own-key” approach, which allows your organization to retain control over access to the inference provider. The AI runs in your already-vetted cloud services.

There are currently two available inference providers: Anthropic and Bedrock. When using Anthropic, you provide an API key. When using Bedrock, Row Zero will assume a role within your AWS account.

Enabling AI for your organization

The AI Provider Settings page allows workspace administrators to configure AI features for their organization. This includes selecting an AI provider (Anthropic or AWS Bedrock), configuring which models are available to users, and managing provider credentials.

Setting Up Anthropic as Your AI Provider

Prerequisites

  • Access to the Anthropic Console for your organization
  • Admin access to your Row Zero organization

Step 1: Obtain an Anthropic API Key

  1. Log in to your Anthropic Console
  2. Navigate to API Keys
  3. Click Create Key
  4. Give your key a descriptive name (e.g., "Row Zero Key")
  5. Copy the generated API key (you won't be able to see it again)

Step 2: Configure Anthropic in Row Zero

  1. Follow this link to your organization settings
  2. Scroll down to the AI section.
  3. In the AI Provider Settings section, click the Provider dropdown
  4. Select Anthropic
  5. Configure your model settings (see Model Settings below)
  6. Under Provider credentials, enter:
    • Key name: A name (like the one set in the Anthropic console) that helps you identify the key.
    • API key: Paste your Anthropic API key
  7. Click Test Connection
  8. Wait for the status indicator to show Connected (green)
  9. Click Save Changes

Note: If the connection test fails, verify that your API key is correct and has not been revoked in the Anthropic Console.

Setting Up AWS Bedrock as Your AI Provider

Row Zero will assume an IAM role in order to make requests to Bedrock on your behalf.

Prerequisites

  • An AWS account with Bedrock enabled in your desired region
  • Permissions to create IAM roles in your AWS account
  • The ability to configure cross-account IAM role trust policies
  • Admin access to your Row Zero organization

Step 1: Start Bedrock Configuration in Row Zero

  1. Follow this link to your organization settings
  2. Scroll down to the AI section.
  3. In the AI Provider Settings section, click the Provider dropdown
  4. Select Bedrock
  5. Configure your model settings (see Model Settings below)
  6. Under Provider credentials, you'll see two fields:
    • Role ARN: (empty - you'll fill this in later)
    • External ID: A unique identifier generated by Row Zero (visible and copyable)
  7. Click the copy icon next to the External ID field to copy the value
  8. Keep this value handy - you'll need it when creating the IAM role

Important: The External ID is a security mechanism that prevents the "confused deputy problem" in cross-account access. See AWS’s explanation for details. Do not share this ID outside of your AWS role configuration.

Step 2: Create an IAM Role in AWS

  1. Log in to the AWS IAM Console
  2. Navigate to Roles → Create role
  3. Select AWS account as the trusted entity type
  4. Choose Another AWS account
  5. Enter the Row Zero AWS account ID: 732940336628
  6. Check Require external ID
  7. Paste the External ID you copied from Row Zero
  8. Click Next

Step 3: Attach Bedrock Permissions

  1. Click Create policy to create a new policy, or select an existing Bedrock policy.
    • Anthropic models through Bedrock require aws-marketplace access. The minimal required list of actions is shown in the JSON document below.
  2. If creating a new policy, use this JSON:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "bedrock:Get*",
                "bedrock:List*",
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream",
                "aws-marketplace:ViewSubscriptions",
                "aws-marketplace:Subscribe",
                "aws-marketplace:Unsubscribe"
            ],
            "Resource": "*"
        }
    ]
}
  1. Name your policy (e.g., RowZeroBedrockAccess)
  2. Attach the policy to your role
  3. Click Next

Step 4: Name and Create the Role

  1. Give your role a descriptive name (e.g., RowZeroBedrockRole)
  2. Add a description (e.g., "Allows Row Zero to access Bedrock models")
  3. Click Create role
  4. After creation, click on your new role
  5. Copy the Role ARN (it will look like: arn:aws:iam::123456789012:role/RowZeroBedrockRole)

Step 5: Complete Configuration in Row Zero

  1. Return to the Row Zero AI Provider Settings page
  2. Paste the Role ARN into the Role ARN field
  3. Click Test Connection
  4. Wait for the status indicator to show Connected (green)
  5. Click Save Changes

Troubleshooting: If the connection test fails, verify:

  • The Role ARN is correct
  • The External ID matches exactly
  • The trust policy allows the Row Zero AWS account
  • Your role has the necessary Bedrock permissions
  • Bedrock is enabled in your AWS region
  • If you are updating an existing role with a new externalId, it may take a little while for the change to propagate. Try again after 60 seconds.

Model Settings

Model settings control which AI models are available to users in your organization and which model is selected by default.

Allowed Models

  • Check the boxes for models you want to make available to your users
  • At least one model must be selected
  • Each model has a tooltip describing its capabilities

Default Model

  • Select which model should be used by default when users access AI features
  • The default model must be one of the allowed models
  • Models marked with "(recommended)" are suggested defaults for most use cases

Note: If you uncheck the current default model, Row Zero will automatically select a new default from your allowed models.

Modifying Existing Settings

Changing Model Settings Only

  1. In the AI section, modify the Allowed models checkboxes or Default model dropdown
  2. Click Save Changes

Note: Changing model settings does not require re-testing your provider connection.

Changing Provider Credentials

To change providers or update credentials, follow the same steps as setting up a new provider.

Note that for Bedrock, a new External ID will be generated when changing IAM roles.

Disabling AI Features for your organization

  1. Select Disabled from the Provider dropdown
  2. Click Save Changes

Note: Disabling AI will remove access to AI features for all users in your organization.

Connection Status Indicators

When testing provider connections, you'll see one of these status indicators:

  • 🟡 Connecting... - Testing the connection (yellow)
  • 🔴 Connection failed - Unable to connect (red)
    • Check the error message below the status for details
  • ⚫ Not connected - No test has been run yet (gray)
  • 🟢 Connected - Successfully connected (green)

Important: You must achieve a Connected status before you can save new provider credentials.

Troubleshooting

Anthropic Connection Failures

"Invalid API key"

  • Verify the API key is correct and hasn't been copied with extra spaces
  • Confirm the key hasn't been revoked in the Anthropic Console

Bedrock Connection Failures

“Failed to assume role”
By design, AWS does not provide distinguishable error messages for different types of failures. Some of the common ones are:

  • Make sure the role ARN was copied with no typos or extraneous spaces.
  • If anything in the trust policy was changed, it can take a few seconds to propagate through AWS.

“You have not agreed to the terms and conditions needed to use model”

  • Anthropic’s models require you to fill in some terms and conditions for use within Bedrock.
  • Follow Anthropic’s guide for more details.

Security Considerations

Credential Storage

  • API keys are encrypted at rest and never displayed after initial entry
  • External IDs are cryptographically signed to prevent tampering
  • Provider credentials are never exposed to workbook processes

AWS Bedrock Security

  • Row Zero uses cross-account role assumption with External ID validation
  • Your AWS credentials never leave your AWS account
  • The role permissions can be scoped to specific Bedrock models or regions
  • You can revoke Row Zero's access at any time by deleting the IAM role

Access Control

  • Only organization administrators can modify AI provider settings
  • Changes to provider settings affect all users in the workspace
  • Users can only access models that have been explicitly allowed

FAQs

Q: Can I use different providers or different settings for different users?
A: No, the AI settings are configured at the organization level and the same settings apply to all users.

Q: I turned on AI; why can nobody see it?
A: AI features are in a limited beta. Contact support@rowzero.io to give your users access to AI features.