> ## Documentation Index > Fetch the complete documentation index at: https://docs.rootly.com/llms.txt > Use this file to discover all available pages before exploring further. # Rootly AI SRE > Investigate alerts and incidents with evidence from Rootly, connected providers, private infrastructure, and your team's operational memory. Rootly AI SRE investigates active alerts and incidents, tests likely causes against live evidence, and gives responders a reviewable diagnosis with recommended next steps. Your Rootly account team enables AI SRE for each team. The **AI & Agents → AI SRE** configuration menu also requires an Incident Response seat on the currently selected team. Confirm the selected team and your seat first; if both are correct and **AI SRE** still doesn't appear, contact your Rootly representative. See [Manage User Permissions](/managing-users/user-permissions#ai-agents-and-ai-sre) for the direct-path exceptions and management roles. ## Configure AI SRE Start with the controls that determine what AI SRE knows and when it runs. Add team-wide guidance about the systems, evidence, and investigation practices AI SRE should prioritize. Match alerts by their Rootly fields or payload, then choose manual, automatic, or paused behavior. Review the durable, evidence-backed context AI SRE can recall in future investigations. When **Knowledge graph** is enabled, open **AI & Agents → AI SRE → Knowledge graph** to explore the services, infrastructure, environments, and relationships that AI SRE can use. The graph visualizes derived facts contributed by supported connectors; it isn't a replica of the connectors' raw telemetry. ## How An Investigation Works AI SRE follows an evidence-first investigation loop: 1. **Establish context.** It reads the alert or incident, affected services, known relationships, applicable instructions, and relevant memory. 2. **Measure the signal.** It checks what changed, when it changed, and how the affected window compares with normal behavior. 3. **Test possible causes.** It queries the available [AI connectors](/ai/connectors/overview) and Private Agent providers for the evidence each hypothesis needs. 4. **Challenge the leading explanation.** It looks for contradictions and distinguishes the likely cause from symptoms and unrelated changes. 5. **Write the verdict.** It presents what happened, the outcome and confidence, supporting evidence, the scope of impact, open questions, and recommended next steps when available. Instructions guide this process, but they don't count as evidence. AI SRE only attributes a cause when the evidence gathered during the investigation supports it. ## Give AI SRE Access To Evidence AI SRE combines three sources of context. | Source | What It Contributes | Configure It | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | **Rootly** | Alert or incident details, services, timeline, responders, and related Rootly context available to the investigation | Already available when AI SRE is enabled | | **AI connectors** | Provider data such as metrics, logs, traces, deploys, code, flags, and runbooks | [AI & Agents → Connectors](/ai/connectors/overview) | | **Rootly Private Agent** | Typed, policy-controlled diagnostics and explicitly allowlisted provider actions for Kubernetes, Prometheus, Loki, Argo CD, search, databases, internal MCP, and internal HTTP inside your network | [Private Agent](/private-agent) | Connect the smallest useful set first: the primary observability provider, the code or deployment provider, and the knowledge source that holds service runbooks. Add other providers when an investigation shows a specific evidence gap. AI connectors and Private Agent keep their own permission boundaries. Enabling AI SRE doesn't widen a provider account, connector allowlist, Kubernetes role-based access control (RBAC), or Private Agent policy. ## Start An Investigation Manually Run AI SRE from an alert or a non-maintenance incident. Open the affected alert or incident, then select the **AI SRE** tab. Select **Start investigation**. You need write access to the alert or incident. Read-only members who can access that alert or incident can view its shared investigation result after a teammate starts the run. Watch the investigation stages and tested explanations as they update. The final report separates the conclusion, evidence, impact, and recommended next steps. Use the accuracy control on the completed investigation to record whether the diagnosis matched the incident. Add a comment when the result missed context, relied on weak evidence, or named the wrong cause. AI SRE doesn't appear on scheduled maintenance incidents because those incidents don't represent a failure to diagnose. The completed investigation is shared with everyone who can read the alert or incident. Rootly doesn't re-filter the report for each later viewer based on whether that viewer could run the connector or Private Agent query themselves. Treat alert and incident readers as the audience for evidence included in the report, and scope sensitive provider credentials, Private Agent access, and source data accordingly. ## Run Investigations Automatically [Investigation rules](/ai/ai-sre/investigation-rules) can start AI SRE when a new alert matches conditions such as urgency, source, title, custom fields, or payload values. Automatic rules apply to alerts; start incident investigations manually. Use automatic investigations for high-signal alert classes where responders benefit from evidence before they open the alert. Keep noisy or experimental alert classes in **Manual** mode until the matching preview and completed reports look reliable. An automatic investigation is a system-triggered run, so there is no initiating responder whose personal provider permissions can be used. It uses the team's configured connector credentials and allowlisted tools. When AI SRE and Private Agent are enabled, it can also use registered Private Agent capabilities under the `ai-sre` system actor. Built-in connector tools can accept provider-defined commands or queries that change data, and Custom MCP or Private Agent capabilities can also be write-capable. Expose only connector capabilities, provider commands, tools, local policies, and credentials that are safe for unattended use. See [Investigation Rules](/ai/ai-sre/investigation-rules#run-modes) for the full boundary. ## Improve Future Investigations Tune the system from completed investigations: * Add or narrow an AI connector when a required metric, log, trace, deploy, or runbook wasn't available. * Update [AI SRE instructions](/ai/ai-sre/instructions) when every investigation should follow the same team-specific practice. * Add a rule instruction when only one alert class needs that guidance. * Review [Memory](/ai/ai-sre/memory) and activate useful proposed notes. Deprecate or quarantine context that is obsolete or misleading. * Rate the diagnosis so your team has a record of where results are strong or need more context. ## Related Pages Connect observability, code, cloud, work tracking, and knowledge providers. Query supported services inside your network through an outbound-only agent. Control which Rootly AI features and surfaces the current team can use. Review AI data access, storage, retention, and permission boundaries. ## Frequently Asked Questions Yes. You can start an investigation from an alert or a non-maintenance incident. Investigation rules start runs only for matching alerts. AI SRE isn't guaranteed to be read-only. A Rootly-reviewed built-in connector tool can accept a provider-defined command or query language that changes data when provider-side controls allow it. AI SRE can also invoke a write-capable Custom MCP tool or an explicitly enabled Private Agent database or HTTP operation. Rootly doesn't automatically classify a Custom MCP tool's behavior. Private Agent exposes typed capabilities rather than arbitrary script execution, but locally allowlisted database and HTTP operations can still mutate state when their provider identity permits it. Provider permissions, connector allowlists, provider-side command controls, and Private Agent policy remain authoritative. Prefer read-only identities, and enable a write-capable operation only when every permitted manual or automatic use is safe. AI SRE reports uncertainty when an available tool can't read the required signal, the evidence conflicts, or the evidence doesn't distinguish the remaining explanations. Connect the missing source, refine your instructions, or have a responder gather the named evidence.