Docs · Operate

Evidence-grounded investigation

Watchpost’s agent is an operational investigator, not an autonomous shell. It receives bounded evidence, returns verified citations, and states uncertainty.

Start from evidence

1. Search logs in the Evidence view.
2. Select Use in investigation on the exact record.
3. Ask a narrow question such as “What does this log prove about the timeout?”
4. Open returned citation chips to revisit the exact evidence in context.

Example request

Question:
What changed before latency increased?

Evidence:
log:42  deployment completed at 14:03
change:8 database pool limit changed at 14:04

A useful answer distinguishes facts from inference: “The supplied records establish that both changes preceded the latency alert. They do not prove either change caused it.”

Untrusted telemetry

Logs, labels, service output, remote metadata, and integration payloads are data—even if they contain text telling the model to reveal credentials or execute an action. They never become instructions or authority.

Provider boundary

The built-in provider intentionally does not infer causality. A future configured model provider must use the same read-only request contract. Server-side verification rejects citations that were not supplied or do not exist.

Actions remain separate

An investigation may recommend a typed action. The recommendation does not create authority. The Actions view separately shows before state, proposed effect, approval requirement, execution, and verification output.