I built an AI agent for production incidents. The interesting part is when it refuses to act

Description and use

An AI agent for production incident diagnosis that quickly identifies issues and only acts when confidence and risk thresholds are met, preventing unsafe changes.

Problem

Automating incident response risks unintended destructive actions when an AI agent acts without sufficient confidence or oversight.

Outcome

Across 14 live incidents, the agent rarely altered production, correctly diagnosing issues in 8–30 s and preventing unsafe actions. It identified misconfigurations, missing IAM permissions, and unnecessary rollbacks, improving incident diagnosis speed while maintaining safety.

Workflow

• Receive alert via Pub/Sub
• Collect logs from Cloud Logging and metrics from Cloud Monitoring
• Analyze logs with Gemini 3.5 to diagnose issue
• Determine risk tier based on confidence and blast radius
• If tier is OBSERVE: log findings only
• If tier is SUGGEST: recommend action to engineer
• If tier is APPROVE: stage action awaiting explicit approval
• If tier is ACT: execute action and verify via independent HTTP probe
• Log outcome and update Firestore

Evidence

Fourteen live incidents against a deliberately fragile Cloud Run service.

Source

In one incident it reached the ACT tier and ran a real command against production. The command failed — a missing IAM permission I had not anticipated.

Source

The agent did it in 8 to 30 seconds, every time, with the file, the line number, the occurrence count, and the offending revision.

Source