Remediation actions

What it's for

Some tickets aren't code bugs — a stuck deployment, a service that needs restarting, a bad release that needs rolling back. Remediation actions let the AI propose an operational fix like this, alongside or instead of a draft pull request, on any on-prem agent (see On-prem agents).

There's no separate connector per cloud or platform. You already run kubectl, aws, az, gcloud, a Jenkins/ArgoCD/TeamCity/Terraform client, or a plain script from wherever your agent lives — a remediation action is just one of those commands, published to a catalog the AI can select from.

The AI never writes a command

You author a fixed catalog on each agent: a name, a platform label, a description, the parameters it takes, and a command template with {placeholder} slots for them — for example kubectl rollout restart deployment/{deployment} -n {namespace}, taking namespace and deployment. The AI can only select one of these by exact name and supply values for its declared parameters. It cannot invent a new action, and it never sees or writes the underlying command.

Parameter values are checked against a strict allow-list (letters, digits, and '_.:/=-' only) before the command is resolved — anything that looks like it's trying to break out of its own parameter (a semicolon, a backtick, a pipe) is rejected outright, not escaped.

A human always approves first

A proposed action shows up on its ticket fix's own page with the fully-resolved command spelled out — exactly what will run, not a description of it. Nothing executes until you click Approve, which dispatches it to the same on-prem agent as any other job; the agent picks it up on its next poll and reports back pass or fail. Reject discards it with no further trace on your infrastructure.

Approving requires the organisation-admin role, not just the engineer role that manages connectors and agents — a deliberately higher bar than configuring a credential, since this is a real write against production.

Set it up

1. On-prem agents → open an agent → Remediation-action catalog → Add action
2. Name it, pick a platform label, list its parameters, and write the command template using those parameters as {placeholders}
3. Save — a template whose placeholders don't exactly match its declared parameters is rejected immediately, not the first time the AI tries to use it
4. When the AI proposes it on a ticket, review and approve it from that ticket fix's own page