Most investigations stop at the first plausible explanation
Root cause work fails predictably. Someone finds an explanation that fits, everyone is tired, and the investigation ends. That explanation is usually a real contributing factor, but not the whole story, which is why the same incident recurs in a different form three months later.
A real investigation asks what would have to be true for the explanation to be complete, then checks. That is a sequence of decisions about where to look next, each depending on what the last one returned.
The work is also bounded. At some point the evidence needed no longer exists. Logs are rotated, or a metric was never collected, and saying so is a legitimate result.
The agent investigates and writes what it found, what it ruled out, and where the evidence stopped. It changes nothing, and the people who were there review the conclusion.
How the agent is built in Agent Studio
Investigation scope lives in prompt skills: which data sources exist, what retention each has, and which systems the agent may query at all.
A second prompt skill holds your architecture as dependencies rather than as a diagram, because the question after every finding is: what else touches this?
The system prompt requires each step to state what it tests and what each result means, which helps prevent an investigation from becoming a confirmation search.
It requires that contributing factors be listed separately from the primary chain. The agent must state when evidence has run out rather than reason past the gap.
A Manual trigger starts the investigation after the incident closes, and an HTTP Request node gives the Agent Chat node query access to logs, metrics, and deployment history within the declared scope.
The agent's session is durable, so a long investigation retains its earlier findings rather than restarting from the beginning.
Findings go to Google Docs as the review draft. Notion files them against the service. A Human in the Loop node keeps the incident lead between the draft and any resulting actions.
What this agent is built from
- Prompt skills: available data sources, their retention, and what may be queried.
- Prompt skills: your architecture expressed as dependencies.
- System prompt: each step states what it tests and what each result would mean.
- System prompt: contributing factors are separated from the primary chain. Exhausted evidence is stated plainly.
- Manual (Triggers): runs after the incident closes, never during it.
- Agent Chat (Util) with HTTP Request (Util): a durable session with scoped query access.
- When an ActionFlow is enough: If you are assembling the timeline and impact from records, build the workflow. That is where an investigation should start.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.