Agent cautions and limits
The AI Monitoring Agent is a helper for the people who run your pipelines. It is not a replacement
for them. Read this page before you raise its level, and again before you let it retry anything.
It can be wrong
- A diagnosis is a best guess. Each insight shows the evidence behind it. Read the evidence
before you act. Treat a diagnosis you cannot tie to the evidence as a hint to investigate, not a
conclusion.
- Look at the badge. Every card says where it came from: AI-generated, Rule-based or
Detector. A rule-based or detector card used no AI model. When the AI service is unavailable,
over its budget or not confident enough, the agent falls back to its built-in rules, so the
explanation may be shorter and less specific.
- It sees only what it is allowed to read. That is the platform's message, the run record and
the settings you permit. It cannot see inside your pipeline code, your data or the systems
downstream. A failure that reports a vague message gets a vague explanation.
- Depth varies by platform. The agent explains failures from some platforms in more detail than
others, and that coverage changes over time. Do not assume every platform gets the same depth.
- Tell it when it is wrong. Rate each diagnosis. Ratings are how accuracy is measured.
A retry is a real run
A retry runs your task again, on the platform, and it counts towards your run allowance.
- It can repeat a side effect. Appends, payments, notifications and downstream triggers can
happen twice. Read When is a retry safe? first.
- Safe to repeat is your promise. The agent cannot check it. If you mark a task safe to repeat
and it is not, a retried timeout can duplicate work.
- A retry does not fix the cause. If a credential has expired or a path has moved, a retry fails
the same way. The agent does not retry those failures.
- A partly executed run is the riskiest. If a run changed data before it failed, treat a retry as
unsafe until you know the task tolerates it.
Approve the action, not the headline
At level 2 a person decides every retry. That only protects you if the decision is a real one.
- Read the card, the warnings and Why? before you choose Approve retry.
- Check the expiry. Approving an old proposal is refused if the run has since changed, but do not
rely on that.
- Do not approve in bulk without reading each one.
- Your approval is recorded in the audit trail against your user.
Try Act within limits with caution
A standing authorization lets the agent retry without asking, so treat it like access you are
handing to someone else. Level 3 is available when it is turned on. We recommend working up to it:
Observe first, then Recommend, then a narrow authorization once you trust the proposals.
- Cover the smallest scope that does the job, such as one platform or a few named tasks.
- Set tight limits and the shortest expiry that makes sense. Nothing renews it automatically.
- Review what the agent did under Agent activity on a regular basis, and revoke a grant you no
longer need.
- Do not rely on automatic suspension. If the administrator who granted it is deactivated, the grant
is suspended, but review your grants when people leave or change role.
- A grant never overrides the checks. It cannot make the agent retry a failure it never retries, or
retry a task set to Never retry.
- Use quiet hours for the times you do not want anything retried by itself.
Rules: who wins
- A Never in a broader scope beats an Allowed in a narrower one. Setting a task to
Allowed does not help if its platform or the organisation is set to Never.
- A person approving a retry cannot override a Never.
- An administrator's rule is active at once. Read it before you save it, and check the clash warning
on the rules page. Deleting or disabling a rule changes what the agent may do.
- A suggestion, whether from a colleague or from the agent itself, does nothing until an
administrator approves it.
- Your own guidance shapes how the agent writes to you. It can never widen what the agent may do.
What the agent reads
- Error messages can carry secrets. Some platforms echo fragments of connection details into
their error text. The agent removes known patterns, but that is best effort and cannot catch
everything. If that risk matters to you, switch error messages off for the agent.
- Never sent: parameter values, resolved secret vault values and anything that identifies a
person. Those exclusions do not depend on any setting.
- Optional platform error detail is an extra data class. It is off unless you switch it on, it
is available only for some platforms, and it is cleaned the same way as error messages. Switch it
on deliberately, and only if you want that extra detail.
- Do not type secrets or personal data into Ask the agent. What you type is sent to the AI
service, as described on Agent data and privacy.
- Deleting agent data is permanent. It removes insights, feedback, learned rules and failure
statistics, and it cannot be undone.
Limits you will meet
- It runs on a schedule. A failure can wait until the next sweep before it appears. The agent is
not a real-time alerting system. Keep your platform's own alerts for anything urgent.
- Quotas depend on your plan. The shortest sweep interval, how long insights are kept and the
daily cap on agent actions differ by plan. The agent card shows yours.
- Run now has a cooldown, and only administrators can use it.
- Chat has a daily limit per person. It resets the next day.
- Levels 2 and 3 are available when they are turned on. A level that is not turned on is greyed
out on the agent card.
- When AI features are switched off, everything stops. No sweep runs, no model call is made and
anything already queued is abandoned rather than completed.
- The conversation is not stored. Closing the browser session ends it. Nothing is replayed on a
later visit.
- A paused agent stays paused. If the agent pauses its own automatic retries, nothing is retried
until an administrator resumes it.
What it is not
- It is not a substitute for your platform's own monitoring and alerting, or for someone on call.
- It does not fix root causes. It never edits your pipelines, credentials, schedules or settings. The
only action it can take on a run is to retry it.
- It is not a change-control tool. Changes still go through your own process.
- It keeps what it learns about your organisation in your organisation's own data area, where no
other organisation can see it.