The questions that decide fit.
Features in this category have converged: everything investigates, everything summarizes, everything chats. Posture has not. Ask any vendor these ten questions, and the category sorts itself.
The frame
Ten questions, in four themes.
Each with our own answer.
| The question | Our answer |
|---|---|
| Placement3 questions | |
| Where does it run? Vendor cloud, your cloud account, or your cluster? | In your cluster One Helm install. No Infraware control plane exists to run elsewhere. |
| Where does your data go? And who can reach it besides you? | It stays in your cluster Only the calls to the model endpoint you configure leave it, and that endpoint can be a model served inside your own boundary. |
| Who owns the model? Can you bring your key, and can you run it fully local? | You do Anthropic, OpenRouter or Mistral on your own key, or an open-weight model served with vLLM or llama.cpp. |
| Boundaries3 questions | |
| What can it do without a human? And is that a policy or an architecture? | Read-only work Architecture, not a setting: the agent has no write path to switch on. A write runs only on a named engineer’s signature. |
| What exactly can it execute? Is the command surface finite and inspectable, or whatever the model decides? | A fixed allowlist Read-only command prefixes, and a quote-aware parser that rejects anything it cannot fully parse. |
| What happens when something fails? The model is wrong, the parser is confused, a component dies: does it do less, or guess? | It does less Parse errors reject, no report means no action, a downed component pauses the investigation. |
| Accountability3 questions | |
| Whose identity executes? A shared service account, or an identity derived from the human who approved? | A dedicated write account A Kubernetes Job under a write ServiceAccount, separate from the read principal. The audit entry names the approver. |
| Who approved, on what evidence, what ran? Can the vendor answer all three for any given change? | Answered per command One audit entry names the approver, the resolved principal, the command and the outcome. |
| What record exists afterwards? Where does it live, and can you hand it to an auditor or insurer without the vendor’s help? | One entry per execution, in your storage Query it yourself. Nothing routes through us. |
| Proof1 question | |
| Can you verify before you pay? In your own cluster, with the price fixed before you start? | Yes, in your own cluster rotelle, our failure simulator, is open source (Apache-2.0): run the reference failures yourself, then watch the live demo run them. The pilot is scoped on the first call to one number, and it does not change after. |
Check any answer: security and architecture · how it works · pricing
The autonomy question
When it acts on its own, who granted that?
-
Reads
Run on their own, under a read-only policy you set.
-
Writes
Run on a named engineer’s signature: per action, or as a standing signature for one exact context once the record has earned it, revocable in one click.
Two comparisons
Where the posture divides.
-
Against SaaS AIOps agents
They investigate your incidents from their cloud. The divide: where your data and your record live.
-
Against autonomy-first self-hosted agents
The closest relatives: self-hosted, your model, read-only by default. The divide: what happens at the moment of action, and whose name is on it.
How to start