ProjectX Ops Intelligence

The full replayable trace of one run.

Every step in order: the runtime's reason for the call, the tool and its inputs, the PDP's decision, and the outcome — so what an agent did and why is read from the record rather than reconstructed.

This tenant's registered agents, with their tools and guardrails.

Register an agent runtime over an identity principal.

The agent is a principal in the identity pillar; this registers the runtime that plans and calls tools as it. A tool names the one permission it needs and the inputs it accepts, and the guardrails set the allow-list, the step and blast-radius limits, the token and currency budget, and whether destructive steps wait for a human. Nothing here widens what the identity principal may do — a tool call is checked against the narrower of the agent's and the caller's permissions at run time.

Body

RegisterAgentRequest

The six reference agents, as installable presets.

Security Analyst, Ops Responder, FinOps Optimizer, Data Steward, Access Reviewer and Onboarding/Offboarding. Each is a named tool set with safe defaults — read-only agents take no destructive action, acting agents ship approval-gated with a tight blast radius. A preset names the scopes its tools need so an install over a principal that cannot exercise it is refused rather than producing an agent that refuses every step.

Install a reference agent over an identity principal.

The preset supplies the tools and guardrails; you supply the identity principal it runs as and that principal's scopes. The install is refused, with the missing scope named, if the principal cannot exercise the preset — the preset never widens what the principal may do, and the runtime still checks the agent-and-caller intersection on every call.

Body

InstallReferenceAgentRequest

One agent's registration.

Engage the kill switch for one agent, the tenant, or globally.

`{ scope: "agent" | "tenant" | "global" }`. A killed agent stops before its next step rather than after a sweep — the check is on the hot path of every run, so the stop takes effect within seconds. `tenant` halts every agent in the tenant; `global` halts every agent everywhere, the break-glass for a runtime behaving badly across tenants.

Body

KillAgentRequest

Recall an agent's long-term memory, newest first.

Write a fact to an agent's long-term memory.

Short-term memory is the run's own step trace; this is the long-term kind — a fact an agent chose to keep across runs, so a later run does not start from nothing. Scoped to the agent that wrote it: recall reads only this agent's memory, never another's.

Body

RememberRequest

Run an agent against a goal with a planned sequence of tool calls.

Each planned call is held to the guardrails before it runs: the kill switch and the budget are checked, the tool must be on the allow-list and inside the narrower of the agent's and your permissions, the blast radius is not exceeded, and a destructive step waits for approval. Only then is the action authorized against the one PDP as you — a denied step records the denial and the run does not retry around it. Every step is kept for the replayable trace.

Body

RunAgentRequest

An agent's run history, newest first.

An agent's version history, with the stage each has reached.

Publish the agent's current tools and guardrails as a new version.

A version freezes behaviour at a point in time, so the history answers what an agent was allowed to do when it did something. A new version starts in `draft` and reaches runs only by being promoted through canary to live.

Body

PublishAgentVersionRequest

Promote a version along its rollout, or roll it back.

`{ version, to: "canary" | "live" | "rolled_back" }`. A draft reaches live only through canary, so no untested version goes straight to every run; a rolled-back version is terminal. The transition is itself recorded, so a rollback is part of the audited history rather than a quiet reversal.

Body

PromoteAgentVersionRequest

This tenant's metric-backed alert rules, by slug.

Create or replace a metric-backed alert rule.

A threshold over a governed metric — the metric's name, a window in the same words the ask box takes, and a warning and/or critical bound. The rule holds no query, so the number it evaluates is computed through the identical Ask path the metrics endpoint, the ask box and agents use, and a metric whose definition changes changes what the rule evaluates without anyone editing it. The metric must exist in the semantic layer; a rule against one that does not would never fire.

Body

SaveAlertRuleRequest

Evaluate a rule now: compute its metric and fire if it breaches.

The metric is computed through the identical Ask.run path every other consumer uses, authorized as the calling principal. A breach fires through the alert queue with the rule's slug as the dedupe key, so a condition that stays breached is one alert that keeps happening; an evaluation within thresholds fires nothing, and the returned record still carries the value and the metric's certification.

The alert queue, newest activity first.

Fire an alert, or fold it into an open duplicate.

One model for every pillar's alarm. A repeat of an open alert with the same dedupe key folds in — the count grows and the worse severity wins — rather than filling the queue, so the next real alert is not buried.

Body

FireAlertRequest

Volume, precision, MTTA and MTTR by source pillar.

Done by source so a pillar drowning the queue in false positives is found by its poor precision, not by an operator's sense that a pillar is noisy.

Move an alert along its lifecycle.

fired, acknowledged, assigned, resolved, reviewed — a jump that skips acknowledgement or reopens a reviewed alert is refused, so every alert took a path somebody can report on.

Body

TransitionAlertRequest

This tenant's connectors.

Register a connector to an external system.

Notification, incident, ITSM, physical or generic — or a custom connector declaring its own config schema and auth. A connector that authenticates must name its credential.

Body

SaveConnectorRequest

Group related alerts into an incident.

The incident takes the worst severity among its alerts, and carries the ownership and SLA the response is measured against.

Body

OpenIncidentRequest

Record a structured post-incident review with linked evidence.

Named fields — what happened, why, what was done, what changes — plus the URNs of the alerts, clips and audit entries that support the account, linked rather than pasted.

Body

ReviewIncidentRequest

Define an on-call rotation with an escalation chain.

Members rotate through shifts; escalation tiers are pulled cumulatively when an alert goes unacknowledged, because paging the manager instead of the engineer is how a page gets dropped.

Body

OnCallRotationRequest

Ask a question across every pillar.

Returns the answer together with the plan, the query generated for each leg, the permission applied to each leg and the sources read. Every leg is planned by its pillar, as you, before any leg is executed. A leg your entitlements do not reach is dropped at plan time and named in `excluded` — so a short answer always says whether it is short because nothing happened or because you may not see it. `confidence` is below 1.0 whenever something reduced the answer, and `answer.caveats` says what. A word the parser did not understand is reported rather than ignored.

Body

AskRequest

Compile the question and return the plan without running it.

Same authorization and the same per-leg pillar planning, no execution and no meter. What the answer view calls to show “this is what I am about to read”, and what an operator uses to find out which legs a policy will refuse.

Body

AskPlanRequest

Ask the same question as structure rather than as English.

`{ subject, intent, constraints: [{attribute, value}], window: { phrase } | { start, end }, absent: [...] }`. For saved questions, scheduled reports and agents, where a parser improvement silently changing what a stored question means would be a bug. Takes business vocabulary only — no dataset, column or predicate — and shares every downstream step with `/v1/ops/ask`, including plan-time entitlement filtering.

Body

StructuredQueryRequest

Saved questions visible to you — your own, plus the tenant's shared ones.

Save a question to re-ask.

Stores the question, never the answer — a shared saved question is re-run as whoever runs it, so it returns each person the answer their own entitlements allow and can never leak the saver's rows.

Body

SaveQuestionRequest

List governed metrics with their certification status.

One metric's definition, unit, version and certification.

Compute a metric over a window.

`{ window: "last month" }`, in the same words the Ask box takes. Runs the identical code path an asked question runs — the metric is turned into a question and planned, authorized and executed exactly as one. That is what makes the number here and the number in an answer the same number rather than two implementations that agree today.

Body

ComputeMetricRequest

The semantic layer: entities, relationships, mappings, metrics.

The vocabulary the ask plane answers to, including the synonyms. Entities with no mapping are listed on purpose — a question about one resolves and then discloses that no pillar records it yet.

List this tenant's workflows.

Create or replace a workflow.

The same structure the visual builder produces and code writes — a trigger, conditions and actions. Every action names the permission it authorizes against as the triggering principal; one that names none is refused, because an action the PDP cannot be asked about is one that would run unauthorized.

Body

SaveWorkflowRequest

One workflow's current definition.

Roll a workflow back to a prior version.

The prior definition becomes current under a new version number, so the history stays append-only and the rollback is itself a recorded change.

Body

RollbackWorkflowRequest

Run a workflow, or simulate it with no side effects.

`{ dry_run: true }` plans and authorizes every action exactly as a real run would, and takes none of them — a faithful preview of what would happen and what policy would allow. Either way every action is authorized against the PDP as you, the triggering principal: a workflow that was approved does not let an action skip that, because approval is consent to the workflow and authorization is per action.

Body

RunWorkflowRequest

A workflow's run history, with inputs and per-step outcomes.

A workflow's version history, for rollback.