Anyone who can open a support ticket can now talk to something that reads all of production. Yedidya built it: an autonomous AI agent living inside the production cluster, triggered by a ticket webhook, investigating 20 data sources (OpenSearch, RDS, BigQuery, logs, and Kubernetes) and replying directly to the ticket. Always read-only.

He tried every open-source investigation agent he could find; none were safe enough to give production access. So he built his own — and the hard part was never the investigation; it was the defense.

Attendees will walk away from the session with: the read-only-by-construction pattern for giving an agent production access, with no write tool available to call; the guardrail stack — a locked-down tool surface, network and RBAC limits, and prompt-injection defenses — that treats every ticket as untrusted input; how to stream an LLM's own traces into application performance monitoring (APM); the one NetworkPolicy that silently broke it; and an honest look at where it helped reduce the on-call burden — and where it answered with full confidence and was wrong.