Investigate
Copilot
The copilot answers questions about incidents, services and logs in Thai or English, and cites the evidence for every claim. It uses the same permission-checked tools as the console, so it can show only what the person asking can see.
How it works#
Tools and permissions#
The copilot investigates through five tools: logs, metrics, incidents, topology and runbooks. Permissions are enforced in the tools, not in the prompt. A question cannot widen access, and a viewer who asks for data their role cannot see is refused with an alternative they can see.
Role is checked again on every read and every tool call, not once when a conversation starts.
Citations#
Each factual statement cites a tool result or a runbook passage. Each citation reopens the result it came from. If the copilot cannot find evidence, it says so rather than answering from general knowledge.
Languages#
Questions and answers work in Thai and English. Technical identifiers, such as service names and template text, stay as they are in either language.
Conversations#
A conversation is private to its user and tenant. If a user's role is downgraded, restricted history from earlier in the conversation is no longer readable.
Answers stream as they are written, so text appears while the copilot works.
Example questions#
| Question | What the copilot does |
|---|---|
Is this payments-gw or us? | Compares the incident's candidates, cites the cause assessment and the evidence, and answers whether the cause is the provider or a service you run |
payments-gw มีปัญหาอยู่ไหม? | Answers in Thai, with the same citations and identifiers unchanged |
| A viewer asks for a restricted log attribute | Refuses, and offers what the viewer's role can see |
The answer changes with the evidence. For an incident whose cause assessment ranks a provider, the answer to the first question is that the provider is the likely cause; when providers are healthy and a single service shows the errors, the answer is that the cause is on your side.
What you see in the console#
The copilot is a panel on an incident and a global panel. Each answer carries numbered references; hovering or focusing a reference highlights the matching evidence.
Show me the raw payment logs for card ending 4417.
You don't have access to raw payment logs. I can show the masked error summary for payments-gw instead.
Limits and defaults#
- It reads data through bounded tools and cannot run arbitrary queries.
- It never sets a confidence score, a cause class or an approval.
Failure states#
| State | What happens |
|---|---|
| Restricted request | Refusal with an alternative the role can see |
| No evidence found | The copilot says it found none |
| Model endpoint unavailable | The copilot says so. Detection, correlation and the computed cause ranking continue |
| Role downgraded | Restricted conversation history is no longer readable |
Related#
Last updated October 2026