Field manuals
for the watch.

guide · 01

Connect your first agent fleet

Any agent can report into the command center through the ingest API. One POST per event — the pipeline takes it from there: baselining, drift detection, escalation, audit.

Send heartbeats even when nothing is wrong — silence is data too. An agent that stops reporting gets flagged exactly like one that's failing.

guide · 02

Write a monitoring pack

A pack is a manifest plus detectors. Declare what you watch, the tolerance band, and what happens when it breaks — the command center handles scheduling, state, and escalation plumbing.

Start from one signal and one threshold. A pack that watches a single metric well beats a dashboard that watches twenty badly.

guide · 03

Design escalation policy

Every severity needs an owner and a clock. A workable starting policy:

• Critical — page the on-call immediately; auto-quarantine the agent until a human clears it.
• High — notify the owning team within 15 minutes; agent continues under supervised autonomy.
• Elevated — queue for next-business-day review; no paging.
• Low — log to the audit trail; review in the weekly oversight pass.

Review the policy quarterly. The policy that was right for five agents will be wrong for fifty.

guide · 04

The kill-switch runbook

When an agent goes rogue, speed matters more than elegance:

• 1. Quarantine. Flip the agent's autonomy to manual — it stops acting, keeps reporting.
• 2. Freeze the blast radius. Revoke its credentials and connector access from the policy page.
• 3. Read the trace. Pull the failing event plus the ten prior events from the escalation — that's your root cause kit.
• 4. Decide in the open. Resolve, retrain, or retire — and let incident-scribe write the record.

Practice this on a staging agent before you need it for real. Runbooks rot; drills don't.

guide · 05

Read the audit log

Every human action and every system escalation decision is recorded — who did what, to which agent, and why. Query it like the source of truth it is:

If an intervention isn't in the audit log, it didn't happen. That property is what makes the log admissible — to your board, your auditors, and your future self.