AegisOps AI

Resolve outages before the war room fills up.

AegisOps AI is a Security/IT Operations command center where a crew of six specialized agents work an incident end-to-end — from intake to a sealed audit trail — coordinated by a UiPath Maestro sequential workflow with human-in-the-loop manager approval gates.

Inspiration

Every on-call engineer knows the 2 a.m. scramble: a critical alert fires, a war room spins up, and ten people copy-paste logs while the clock burns SLA budget. Most of that work is triage — boring, repeatable, and perfect for agents. But the dangerous 20% (running a remediation that could make things worse) needs a human. We wanted automation that knows when to ask.

What it does

A filed incident moves through a sequential pipeline:

Intake — classifies the ticket and assigns a severity vector
Log Forensics — scans uploaded logs for fatal traces, builds a timeline
Knowledge (RAG) — retrieves matching SOPs / runbooks from a vector store
Root Cause — fuses anomalies + SOPs and scores a confidence %
Resolution — drafts a fix with rollback safe-fails and a risk grade
Audit — seals an immutable record of every decision, retry, and override

An escalation gate halts the workflow when severity is critical or root-cause confidence drops below 70%, routing it to a manager. Approve → remediation resumes. Reject → it's logged. High-confidence, low-severity incidents auto-remediate.

How we built it

Orchestration: a UiPath Maestro–style master workflow drives the agent sequence, the retry loop (up to 3× per agent on transient failure), and the approval gate.
Agents: six coded CrewAI agents, each owning one stage and handing a structured verdict to the next.
Backend: FastAPI + SQLAlchemy, JWT auth with role-based access (only managers/admins can approve), background-task dispatch so agent progress streams to the UI in real time.
Knowledge: ChromaDB vector store for SOP retrieval, with a SQL keyword-matching fallback.
Frontend: Next.js 15 (App Router) + React 19 + Tailwind v4, an "Operational Broadsheet" editorial design with a live agent-stdout console.
Simulation mode: the whole platform runs with zero API keys in a deterministic mode, so judges can docker compose up and see agents work in under three minutes — no LLM bill, no flaky external calls on stage.

Challenges we ran into

Knowing when to escalate. Encoding "ask a human" as a deterministic gate ( \( severity = critical \lor confidence < 70\% \) ) instead of a vibe.
Making async agents visible. Agents are fast; humans need to watch them reason. We stream each agent's execution + result as rows the UI polls.
Graceful degradation. Any LLM error silently falls back to simulation so a live demo never dies mid-pitch.

What we learned

Multi-agent systems are only as trustworthy as their guardrails and audit trail. The hard part isn't getting agents to act it's getting them to stop and defer, and proving afterward exactly what happened.