Audit trace
An append-only log — the API exposes no update or delete endpoints for it — of every action taken — by a human or an AI agent — on an incident or within the organization. Every HITL decision, role change, settings edit, and executed action writes an audit trace entry with actor, target, and timestamp, plus event-specific detail captured in structured metadata (there is no standalone “outcome” field). There is no in-app audit browser today — Admins, Owners, and Compliance Officers can retrieve the full audit trace via the API, or by contacting support.Confidence score
A 0–100 score, null when not yet computed. Confidence dials appear at the triage, diagnosis, verification, and closure stages — not only in diagnosis — and on individual recommendations, reflecting how well the evidence in your observability data supports the agent’s conclusion at that point. Higher confidence scores indicate more complete evidence chains. Confidence scores help you prioritize which recommendations to approve first. See Confidence & Audit Trace.Deploy identity
The discovered facts about how a service is deployed — app name, namespace, project, and GitOps sync settings (selfHeal, autoSync) — that sureops uses to ground remediation actions and pick a fix that will actually take effect. It is read-only: sureops observes it at provision time and from your GitOps controller (e.g., ArgoCD), and it can only be corrected with a customer-authored landscape override, never entered inline as a credential. See Deploy identity.
Diagnosis Specialist
The specialist AI agent that runs during the diagnosis stage. It executes a ReAct investigation loop — pulling metrics, logs, traces, and infrastructure state through your connected integrations — and produces a ranked set of recommendations with confidence scores and supporting evidence.ECHO
The AI assistant embedded in sureops for natural-language interaction. ECHO answers questions about your incidents, summarizes what agents did, and explains recommendations — entirely through read-only queries (e.g., incident detail, active incidents) against the same data the specialist agents work from. It is powered by the same LLM stack as the specialist agents. ECHO does not accept customer-typed context injection; the “additional context” text box you may be thinking of is a different feature — a stage re-run field on the Incident Hub (Guided mode only) that feeds the stage-rerun endpoint, not ECHO.HITL (Human-in-the-Loop)
A checkpoint where an AI agent pauses and requests explicit human approval before proceeding. HITL gates appear before resolution executes (in Supervised mode, always; in Self-Driving mode, unless your org has opted into auto-approve), and always for P1/P2 severity incidents and fix-PR recommendations regardless of mode. Only users with the Commander role or higher can approve or deny HITL requests. See HITL Gates.Incident
A time-bounded event indicating something is wrong in your production environment. Incidents in sureops progress through six stages: detection → triage → diagnosis → resolution → verification → closure. Stages don’t map one-to-one to agents: the Incident Commander owns detection, triage, and closure directly, while the Diagnosis, Resolution, and Verification Specialists are invoked for their respective stages. See The 6-stage incident lifecycle.Incident Commander
The AI agent that owns the incident lifecycle overall — it handles detection, initial triage, and closure, and coordinates handoffs between specialist agents. The Incident Commander is always present; specialist agents (Diagnosis Specialist, Resolution Specialist, Verification Specialist) are invoked per-stage as needed.Pre-mortem
A proactive, pre-deploy risk analysis generated for an open pull request — not something that runs during an incident. A standalone agent (independent of the incident graph) reviews the PR diff against your service catalog, runbooks, and incident history when the PR is opened or updated, and produces a structured doc: a list of predicted failure modes (each with a description and a blast radius of affected services), suggested mitigations, an overall risk score (0–10), and an overall confidence score (0–100). There is no separate proceed / proceed-with-caution / escalate verdict field — the risk score and failure modes are what you review. See Pre-mortems.Coming within Growth. Pre-mortems are not yet available on any sureops plan.
Problem
A long-lived record representing an underlying root cause that has produced one or more incidents. Problem creation is policy-gated by severity and closure reason, not every closed incident produces one. A recurrence of an existing problem’s pattern always creates a new problem row linked back to the original — the earlier problem is never mutated or re-opened (see Recurrence chain). Problems are distinct from incidents: an incident is a symptom; a problem is the cause. See Problem management.Recurrence chain
The sequence of problem records linked back to the same original root cause over time. When a new incident matches an existing problem’s pattern, sureops always creates a new problem row for it and links that new row back to the earlier one — a recurrence never re-opens or mutates the prior problem. The chain lets you track how often a root cause recurs and whether fixes are holding. See Recurrence chains.Resolution Specialist
The specialist AI agent that runs during the resolution stage. It executes approved recommendations — restarting services, triggering rollbacks, scaling resources — using the configured deploy identity and logs every action in the incident timeline.SAGE
The AI chat advisor scoped to a single active incident — open it from the SAGE button in the action cluster at the top right of the Incident Hub (alongside Catch Me Up, Escalate, and Promote to Problem) to interrogate the agent’s reasoning in real time, with full context of the current stage, diagnosis, execution logs, and every data source the agent queried. A secondary, problem-scoped variant of SAGE supports deeper root-cause investigations across linked incidents. SAGE is distinct from ECHO, which is the org-wide chat assistant rather than incident- or problem-scoped.Self-driving mode
A control mode in which sureops drives the full incident lifecycle without waiting for you to advance each stage manually. The AI moves through all six stages, notifying your team at key milestones. Self-driving mode does not mean approvals are off by default: auto-executing a recommendation is opt-in, and the post-diagnosis approval gate still pauses for explicit human approval until your org turns on auto-approve for that scope. Even then, auto-execution only applies up to a configured risk ceiling (max_auto_risk, capped at medium) — P1/P2 severity incidents and fix-PR recommendations always require explicit human approval regardless of mode or auto-approve settings. See Control modes.
Skills
Reusable instruction bundles that extend what AI agents can do or know. A skill can inject additional context (e.g., a runbook excerpt), override how an agent approaches a particular class of problem, and carry tool hints that bias which of an agent’s existing tools get emphasized first. Tool hints are a visibility/ordering bias only — they do not grant access to a new tool; a tool must already be bound to the agent (via MCP discovery or a built-in tool factory) for a skill’s tool hints to have any effect on it at all. Skills have two authoring surfaces that write to the same underlying table: Settings → Skills in the UI, or.sureops/skills/*.md files in your knowledge-base repo (see .sureops/). However authored, skills are attached to individual agents (with no per-environment variation) using the Connected Skills toggles on that agent’s configuration card.
.sureops/
A directory in a single, dedicated knowledge-base repository (not scattered across your individual service repos) where you place customer-authored context for sureops: service contracts (services.yaml), policy (policy.yaml), runbooks, postmortems, skills, and operating context (operating-context.md). sureops indexes this directory and makes its contents available to agents during incident and problem investigations. Agent instructions themselves are configured separately, in Settings → AI Agents, not in this repository. See Runbooks & knowledge base.