System Guardian AI Agent

System Guardian checks the patient records system, the lab results link, internal servers and the nightly backup, and knows what a normal night looks like for each of them.

When the lab results link stalled at 02:40, it grouped 48 alerts from different servers into one incident and read the logs to find the cause: a stuck message queue with 1,284 results waiting.

Restarting that queue is a step the team had approved in advance, so the agent ran it, checked that results were reaching the wards again, and stopped there.

The on-call engineer got one short message in Microsoft Teams instead of 48 alerts.

System Guardian reads the identity directory, Okta, the core banking users and the HR leavers list, and builds one picture of who has access to what, instead of a quarterly export.

It highlights people who have left but are still active, contractors whose contracts ended, accounts unused for 90 days or more and admin rights a person's current role doesn't need.

Each manager gets a short list in Microsoft Teams with the reason for every item, and decides Keep or Remove.

Only after a manager signs off does the agent remove the access, using the steps the team approved.

System Guardian reads Datadog and Grafana for every part of checkout, so it sees a slow payment step as a checkout problem, not as dozens of separate alerts.

When the cache disk reached 95% at 10:12, it cleared expired items before pages slowed.

At 14:05 the payment step slowed from 0.4 to 2.8 seconds right after release 4.18.

The agent rolled back through the team's usual release steps in GitHub, watched checkout for ten minutes to confirm it was back to normal, and drafted the write-up for the next morning.

When a security fix is released, the agent checks the asset register for affected servers and the shift plan for the next planned stops, such as cleaning breaks and shift changes.

It proposes one window per line in Microsoft Teams, with the servers, the expected time and the backup status.

Before starting, it confirms the backup system holds a fresh copy and the line is really stopped.

The agent waits until the production line system reports the line ready, posts progress to Teams, logs the change in Jira and only then moves to the next line.

The agent confirms the person in Okta: their department, role and start date.

Account unlocks, password resets, standard lab software and course drives are done in under a minute, within the rules the desk agreed, and logged.

Admin rights, research data and anything outside the rules go to the person who owns that decision, in Teams, with the reason and what the person's colleagues already have.

A broken projector or lab PC becomes a Jira ticket with the room, the asset and what has already been tried, so the technician arrives with the right part.

Alerts that share a cause, such as every service that depends on one slow database, become one problem with one owner instead of hundreds of pages.

For each problem it looks at recent releases in GitHub, new error reports in Sentry and the service's charts in Datadog, and writes a short summary of what it found.

If an approved runbook matches, such as restarting a stuck worker, it runs it and confirms the service recovered.

After a real incident, it drafts the review from the Slack thread, the release history and the charts: timeline, cause and follow-ups, created as Jira tasks once the engineer approves.