Skip to main content
A reference for terminology used throughout sureops and its documentation. Terms are in alphabetical order.

Audit trace

A tamper-evident log of every action taken — by a human or an AI agent — on an incident or within the organization. Every HITL decision, role change, settings edit, and executed action writes an audit trace entry with actor, target, timestamp, and outcome. Admins and Owners can read the full audit trace in Settings → Audit.

Commander agent

The AI agent that owns the incident lifecycle overall — it handles detection, initial triage, and closure, and coordinates handoffs between specialist agents. The commander agent is always present; specialist agents (diagnosis, resolution, verification) are invoked per-stage as needed.

Confidence score

A 0–100 score attached to each recommendation in the diagnosis stage. It reflects how well the evidence in your observability data supports the proposed root cause and fix. Higher confidence scores indicate more complete evidence chains. Confidence scores help you prioritize which recommendations to approve first.

Deploy identity

The service account or credential set that sureops uses when executing approved remediation actions in your infrastructure (e.g., restarting a deployment, triggering a rollback). Configured per environment by Admins. See Deploy identity.

Diagnosis agent

The specialist AI agent that runs during the diagnosis stage. It executes a ReAct investigation loop — pulling metrics, logs, traces, and infrastructure state through your connected integrations — and produces a ranked set of recommendations with confidence scores and supporting evidence.

ECHO

The AI assistant embedded in sureops for natural-language interaction. ECHO answers questions about your incidents, summarizes what agents did, explains recommendations, and accepts context you type during an active incident. It is powered by the same LLM stack as the specialist agents and has read access to the same incident data.

HITL (Human-in-the-Loop)

A checkpoint where an AI agent pauses and requests explicit human approval before proceeding. HITL gates appear before high-risk actions (e.g., restarting a production deployment) and at stage transitions in Supervised mode. Only users with the Commander role or higher can approve or deny HITL requests. See Core concepts: HITL.

Incident

A time-bounded event indicating something is wrong in your production environment. Incidents in sureops progress through six stages: detection → triage → diagnosis → resolution → verification → closure. Each stage is handled by a dedicated AI agent. See The 6-stage incident lifecycle.

Pre-mortem

An AI-generated analysis run during the diagnosis stage that models what further failures could occur if the current incident is not resolved — i.e., what might go wrong next. The pre-mortem identifies at-risk downstream services and dependencies to help responders prioritize containment actions before the blast radius expands.

Problem

A long-lived record representing an underlying root cause that has produced one or more incidents. Problems are created at incident closure and updated automatically when new incidents match the same pattern (see Recurrence chain). Problems are distinct from incidents: an incident is a symptom; a problem is the cause. See Problem management.

Recurrence chain

The sequence of incidents linked to the same problem record over time. When a new incident matches an existing problem’s pattern, sureops adds it to the chain rather than creating a new problem. The chain lets you track how often a root cause recurs and whether fixes are holding. See Recurrence chains.

Resolution agent

The specialist AI agent that runs during the resolution stage. It executes approved recommendations — restarting services, triggering rollbacks, scaling resources — using the configured deploy identity and logs every action in the incident timeline.

SAGE

The AI agent powering problem-level investigations — deeper and longer-horizon than incident response. SAGE runs root cause analyses across linked incidents, generates problem summaries, proposes monitors, and produces fix PR scaffolding. It is distinct from ECHO (the chat assistant) and the incident-stage agents.

Self-Driving mode

A control mode in which sureops drives the full incident lifecycle without waiting for per-stage human approvals. The AI moves through all six stages autonomously, notifying your team at key milestones. High-risk actions and P1/P2 incidents still require explicit human approval regardless of mode. See Control modes.

Skills

Reusable instruction bundles that extend what AI agents can do or know. A skill may add new tools, inject additional context (e.g., a runbook excerpt), or override how an agent approaches a particular class of problem. Skills are configured per-environment under Settings → AI Agents → Skills and can be attached to individual agents.

.sureops/

A directory in your service repositories (or a dedicated knowledge-base repository) where you place customer-authored context for sureops: runbooks, service contracts (services.yaml), and custom agent instructions. sureops indexes this directory and makes its contents available to agents during incident and problem investigations. See Your knowledge base.

Supervised mode

A control mode in which sureops proposes every action and waits for explicit human approval at each stage boundary before proceeding. Nothing executes until a Commander or higher approves. Supervised mode is the recommended starting point for new environments and high-stakes production incidents. See Control modes.

Verification agent

The specialist AI agent that runs during the verification stage. It re-queries the same metrics and health checks that triggered the original alert and confirms whether they have returned to baseline thresholds. If verification fails, the incident escalates rather than being silently closed.

Watchdog

The internal monitoring loop that observes AI agent progress during an active incident. If an agent node stalls, produces an error, or takes unexpectedly long, the watchdog escalates the incident for human review rather than leaving it silently stuck. The watchdog also enforces recovery phase deferral — preventing premature HITL interrupts during service recovery windows.