What does the Diagnostics Agent actually do?

When an Apex monitoring signal fires — uptime, error rate, or a tenant-reported issue — the agent pulls the relevant logs, traces, and tenant context, drafts a diagnosis and a proposed remediation, and posts the result for a human reviewer. Nothing is auto-deployed. The role is to compress the incident-to-context loop, not to take action without approval.

Why did it start on Anthropic Managed Agents and move to Bedrock?

It launched on Managed Agents because the managed runtime handled the long-running, tool-using, retryable execution that incident triage needs — building that orchestration in-house was the gating cost of putting AI into ops at all. When Sentinel consolidated its workloads on AWS Bedrock in May 2026, diagnostics moved onto the shared Bedrock runner; the legacy Managed Agents path stays deployed in parallel behind an atomic per-incident lock until final cutover.

What is the launch posture?

The full path is deployed in production — detector cron, queue, runner, and the admin review queue — and validated end to end against synthetic incidents at a verified $0.0822 per run — about eight cents. Per-tenant activation is still gated: a canary flag controls which tenants the detector considers, and it is currently enabled for none, so the workload idles until flags are flipped tenant by tenant.

Diagnostics Agent — iSimplifyMe Labs

Q: How does the human approval gate work?

The agent writes its diagnosis and proposed action to a queue surfaced inside the Apex admin UI. A reviewer reads, edits if needed, and either approves or discards. Approved actions hand off to the standard deployment path — the same one a human-authored change would take. The agent has no direct write access to production resources.

Sentinel's incident-forensics workload: diagnoses fleet incidents, drafts the response, human approves.

Abstract

The Diagnostics Agent is Sentinel's incident-forensics workload, and it was the first production Anthropic Managed Agents workload at iSimplifyMe before migrating to AWS Bedrock under the Sentinel namespace in May 2026. It runs against incidents surfaced by Apex monitoring, gathers the relevant context, drafts a diagnosis and a proposed remediation, and surfaces both for a human reviewer before anything is acted on. The agent has no direct write access to production resources — its job is context, not action.

Problem

Incident triage for a small ops team is dominated by context-gathering, not decision-making. By the time the relevant logs, traces, and tenant configuration are pulled together, the human reviewing the incident has spent most of their time on rote work that an agent can do faster and more thoroughly.

The hesitation around AI in ops has rarely been about the language model itself. It has been about the orchestration around it: long-running tool use, retries, partial failure, audit trails, and a clean human approval gate that does not auto-execute under failing state. Building that infrastructure in-house was, until recently, the gating cost of putting AI into the incident loop at all.

Approach

One agent, one bounded task

The agent is scoped to operational diagnostics — not deployment, not configuration changes, not tenant communication. The narrow scope is deliberate: each agent does one well-defined operational task, and the human approval gate sits between the agent's output and any action against production.

Runtime: Managed Agents, then Bedrock

The workload launched on Anthropic's Managed Agents runtime, which handled the long-running, tool-using, retryable execution that incident triage actually requires — the internal team owned the prompt, the tool surface, and the approval UI, while the runtime handled the harder parts of the loop. When Sentinel consolidated its workloads on AWS Bedrock in May 2026, diagnostics moved onto Sentinel's shared ConverseStream runner.

The legacy Managed Agents path stays deployed in parallel behind an atomic per-incident lock until final cutover, so exactly one runner owns any given incident.

Approval gate

The agent writes its diagnosis and proposed remediation to a queue surfaced inside the Apex admin UI. A reviewer reads, edits if needed, and either approves or discards. Approved actions hand off to the same deployment path a human-authored change would take. There is no auto-execute path, even on high-confidence diagnoses.

Status

Full path deployed in production end to end — detector cron, queue, Bedrock runner, and the Apex admin review queue — validated against synthetic incidents.
Per-incident cost validated at about eight cents per run ($0.0822 on the synthetic set).
Per-tenant activation is canary-gated and currently enabled for no tenants; the workload idles until flags are flipped tenant by tenant.
The approval-gate pattern is the shared template for the other Sentinel workloads (one agent per well-bounded operational task).

Diagnostics Agent

What is the iSimplifyMe Diagnostics Agent?