Skip to main content
Every action sureops takes — and every human decision that shapes an incident — is recorded in a structured trail. This page explains what you can see, what confidence scores mean, and how to use the audit trace to calibrate your trust settings over time.

​
Confidence scores

​
What they mean

Confidence is not limited to diagnosis — six typed stages each produce their own confidence score: triage, root cause, recommendation, verification, recovery, and closure readiness. (Detection and resolution deliberately show no confidence dial — there’s nothing yet to score at detection, and resolution is execution, not a judgment call.) Each score reflects how well the agent’s output at that stage is grounded in the telemetry evidence it gathered. Confidence is shown as an integer from 0 to 100, mapped to one of three bands:
  • Green (70–100): Multiple independent signals point to the same conclusion. Logs, metrics, and traces all corroborate.
  • Amber (40–69): Strong primary signal, but some corroborating data is missing or ambiguous.
  • Red (0–39): Limited evidence, or the available signals are conflicting. The agent is flagging this as a hypothesis, not a finding.

​
Per-recommendation confidence

Confidence is stamped per recommendation, not just per stage. A diagnosis run may produce one high-confidence root cause and one lower-confidence secondary hypothesis. You can approve the high-confidence action and re-investigate the second.

​
How confidence affects auto-approve

If you have Auto-execute low/medium-risk fixes (autonomous_execution) turned on, the system uses risk classification (not confidence) as the auto-approve gate. However, confidence is surfaced on the approval card so you can decide whether a low-confidence finding warrants a manual review even for a normally auto-approved risk level.

​
Decision trace

Every action the agent takes is written to the incident timeline as a structured entry. This gives you a step-by-step record of what the AI did and why.

​
What the timeline shows

Stage transitions

When each stage started and completed, with the triggering reason (AI-driven, human-approved, or human-manual).

Tool calls

Every query to an observability tool — metric queries, log searches, trace lookups — with the inputs and outputs.

Recommendations

Each recommendation as it was presented, with the reasoning the agent provided and the risk classification.

Approval decisions

Who approved or rejected each recommendation, when, and from which interface (in-app, Slack).

Human control events

When a human took control, released it, rolled back a stage, or marked a stage complete. Including any rationale they provided.

Re-investigation rounds

Each diagnosis re-run, why it was triggered, and what focus the agent was given. Prior rounds stay visible for comparison.

​
Agent-derived and observed facts

The timeline and the post-incident RCA both show agent-derived conclusions (for example, a severity the agent inferred from metadata because a stage was skipped) alongside directly observed facts from your telemetry, with the reasoning for each entry included. There is currently no dedicated UI label that tags an individual entry as inferred versus observed — read the reasoning attached to each entry to see how the agent arrived at it.

​
Audit log

The audit log is a structured record of every significant event across your organization’s incidents. It is distinct from the per-incident timeline in scope and purpose.

​
What the audit log covers

​
Reading the audit log

The audit log is available today via API — filterable by actor, event type, and date range — there is no dedicated Settings tab for browsing it yet. If you need audit records for an investigation or compliance request, contact sureops support and we’ll pull the relevant records for you. The log is immutable — entries cannot be edited or deleted.

​
Using the trace to calibrate trust

The decision trace and audit log are the primary tools for expanding or contracting your automation trust settings.

​
When to widen autonomy

Look at the last 20–30 auto-approved incidents:
  • Were the root cause diagnoses accurate? (Check: did the resolution fix the issue, or did verification fail and require a second loop?)
  • Were confidence scores on auto-approved actions consistently high?
  • Were there any unexpected side effects from actions taken?
If the pattern is clean, consider widening Maximum auto-executed risk (max_auto_risk) from low to medium for your staging environment.

​
When to tighten

Watch for:
  • Low-confidence diagnoses that were auto-approved and led to verification failures
  • Recommendations meant to execute as a fix PR or go to a human being misclassified as directly runtime-executable
  • Any approval that in retrospect should have been rejected
Tighten by lowering Maximum auto-executed risk, or temporarily switching the environment to Supervised mode while you investigate.

​
Human control decisions in post-incident RCA

When a human manually advances a stage, rolls back, or marks a stage complete with notes, those decisions appear explicitly in the post-incident root cause analysis. The RCA includes a “Human Control Decisions” section listing every manual action with its stated rationale and the actor. This means your in-the-moment comments when taking manual actions become part of the permanent record used for future learning.

​
What you cannot change

The audit trail is append-only by design. You can read it and filter it via the API, but you cannot edit or delete entries — no update or delete endpoint exists for audit log rows, so this is enforced at the API surface itself. Self-serve export is an Enterprise-tier capability and is not yet active for any org. If you need an audit log export for a compliance review, contact sureops support and we’ll generate one for you.