Features · AI tiers
Four LLM tiers, each approval-gated.
T0 enricher → T1 fix proposer → T2 multi-step planner → T3 Vault runbook proposer. Every mutation in the paid AI tiers waits on a signed-JWT click-to-fix URL.
The AI SRE paid tier adds four progressively deeper LLM capabilities, each bounded by the operator policy: T0 enriches every DriftReport with LLM context; T1 proposes fixes that the OSS deterministic fixers can't cover, bounded by the operator's action_kind policy; T2 plans multi-step remediations; T3 proposes new vault break-glass runbooks under a dual-approval policy. All four wait on a signed-JWT click-to-fix URL delivered to Slack or ticket. Without the click, nothing mutates — unless you explicitly enable an autonomy tier: either PR auto-merge (off by default; Wilson lower bound ≥0.95) or in-cluster confidence-gated auto-apply (off by default; reversible-action allowlist; confidence ≥0.95). Both require every safety gate to pass.