Remediation actions

What it's for

Some tickets aren't code bugs — a stuck deployment, a service that needs restarting, a bad release that needs rolling back. Remediation actions let the AI propose an operational fix like this, alongside or instead of a draft pull request.

There are two ways an action actually runs, and you can use either or both: the on-prem agent catalog below (for a cloud account or cluster this platform can't reach directly), or a direct cloud connector — see Direct cloud connectors — for an AWS/Azure/GCP account or Kubernetes cluster you're comfortable connecting straight to Noviqent DevOps. Every proposed action shows up on its ticket fix's own page and needs the same human approval either way; the only difference is what happens the instant you click Approve.

There's no separate agent connector per cloud or platform. You already run kubectl, aws, az, gcloud, a Jenkins/ArgoCD/TeamCity/Terraform client, or a plain script from wherever your agent lives — a remediation action is just one of those commands, published to a catalog the AI can select from.

The AI never writes a command

You author a fixed catalog on each agent: a name, a platform label, a description, the parameters it takes, and a command template with {placeholder} slots for them — for example kubectl rollout restart deployment/{deployment} -n {namespace}, taking namespace and deployment. The AI can only select one of these by exact name and supply values for its declared parameters. It cannot invent a new action, and it never sees or writes the underlying command.

Parameter values are checked against a strict allow-list (letters, digits, and '_.:/=-' only) before the command is resolved — anything that looks like it's trying to break out of its own parameter (a semicolon, a backtick, a pipe) is rejected outright, not escaped.

A human always approves first

A proposed action shows up on its ticket fix's own page with the fully-resolved command spelled out — exactly what will run, not a description of it. Nothing executes until you click Approve, which dispatches it to the same on-prem agent as any other job; the agent picks it up on its next poll and reports back pass or fail. Reject discards it with no further trace on your infrastructure.

Approving requires the organisation-admin role, not just the engineer role that manages connectors and agents — a deliberately higher bar than configuring a credential, since this is a real write against production.

Set it up

1. On-prem agents → open an agent → Remediation-action catalog → Add action
2. Name it, pick a platform label, list its parameters, and write the command template using those parameters as {placeholders}
3. Save — a template whose placeholders don't exactly match its declared parameters is rejected immediately, not the first time the AI tries to use it
4. When the AI proposes it on a ticket, review and approve it from that ticket fix's own page