Ops Paladin
AI agents that turn bare alerts into analysed, evidence-backed incident reports, trigger runbooks for specific incident types, and propose small fixes as pull requests.
Near real-time initial incident assessments
01
Why I built it
- On call, alerts landed in Microsoft Teams with almost no context to triage.
- The on-call engineer had to get to a laptop, look up the alert, search the logs, and only then start analysing the issue.
- The tooling around operations is complex, because the tech stack is scattered across clouds, on-prem and many tools.
- AI is great at troubleshooting, driving infrastructure and telemetry tooling, and reading large amounts of logs and metrics fast.
- The idea: package LLMs together with the existing operations tooling for every engineer in the org, to cut friction, speed up response and make triage decisions faster than ever.
Microsoft Teams
02
What it does
- Analyses incidents across platforms, from the telemetry the alert references.
- Groups related incidents into problems.
- Proposes fixes as pull requests.
- Runs runbooks, such as restarting failed jobs, where configured.
- A web UI to troubleshoot each issue, with charts, logs, a timeline and a chat that has the full context.
03
One interface to troubleshoot
- Troubleshooting a multi-cloud system means jumping between consoles, log tools and repos.
- Paladin gives unified access to all of them: telemetry on-prem and in GCP, AWS and Azure, and Git.
- It never talks to any of them directly: a control layer defines exactly what it can query, and logs are only reachable where access is explicitly configured.
- Least privilege at every layer: write actions only go through an allow-list, and sensitive data is redacted before it reaches the model.
- It works where the team already works: Microsoft Teams, Jira and GitHub.
- Any engineer can troubleshoot across the whole system from one place, without knowing every tool.
- GCP
- AWS
- Azure
- Git
- Microsoft Teams
- Jira
- GitHub
04
How it’s built
- Event-driven incident handling with Pub/Sub, and deterministic workflows in Go.
- Built fully on the Cloud Run ecosystem.
- Reports are typed blocks (findings, charts, logs, changes, timeline), not free text.
- Engineers can read reports from their own coding agent through an MCP server.
- Pub/Sub
- Go
- Cloud Run
- MCP
05
Outcome
- Faster first response, and roughly 80% less on-call time by my estimate: most of it was triage, which Paladin now does.
- On-call starts from an analysis with evidence, not a bare alert.
- Reports can be trusted: evidence is collected first, without the model, and every finding must cite it.
- Root causes are easier to find: LLMs work through the evidence, and the web UI visualizes the issue at hand.
- New on-call engineers can respond from day one with far less system knowledge.
- A better developer experience: on-call means less digging and more fixing.
06
Next
- Chat with Paladin right on the alert card in Teams.
- More self-healing: Paladin applies approved fixes and verifies them.