CAIN-42 CAIN StudioAGENTIC AI 75 · #45
IT investigation with approval-gated remediation
ScienceLogic's Skylar AI used live telemetry to investigate incidents and propose repairs.
Last reviewed 2026-11-11
Agentic AI 75 / #45
2026 status: Product release · Category: IT operations
The 2026 development
ScienceLogic's Skylar AI used live telemetry to investigate incidents and propose repairs.
The governance gap
The gap between a diagnosis and a repair is the highest-risk moment in operations. An agent that can restart, roll back or patch production needs an approval that is bound to the exact action.
Where CAIN-42 fits: Moat 5 — Predictive Trust & Blast Radius
Core question: What could happen before we let it happen? Pre-execution analysis of reach, exposure and consequence, including simulations.
Separate diagnosis from remediation, and bind the human approval to the exact action digest, target and expiry. CAIN's approval KEYSTONE already binds approvals to one action and refuses a swapped payload.
How the wiring works
- Produce a diagnosis with the telemetry evidence it used.
- Draft a remediation action with exact target and parameters.
- Request approval bound to the action digest.
- Execute once, then verify the observed effect.
What is real today
LIVE A public route in this deployment exercises this mechanism today, within its stated scope.
The hosted approval demo binds and verifies fixed actions. It does not connect to ScienceLogic or a production estate.
| Component in this repository | What the module says it is |
|---|---|
keystone/approval.py | APPROVAL KEYSTONE: a person approves the exact action, in Slack or by a one-time link, and the approval is proof. |
cain/causality/evidence.py | CAIN CAUSALITY — Causal Evidence Independence Graph (Prompt CAUSALITY, Phase 9). |
cain/telemetry.py | CAIN Trust Fabric - Enterprise SIEM & SOC Telemetry Connectors (Phase 3) |
cain/guard.py | CAIN Trust Fabric - Unified 1-Line Agent Guard Decorator |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Run the live action-bound approval demo
/approval-keystone - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | Approval-Gated Remediation Review |
|---|---|
| Buyer | IT operations and MSPs |
| Price (proposal) | $2,500–$5,000 per review |
| Bundle | Runtime Containment & Evidence — Contain first, then prove what happened. |
| Operator stream | Stream 3 of the 10-stream operator playbook |
SOC, incident response, compliance, enterprise IT is the bundle buyer. The entry offer for this bundle is Runtime containment review; signed evidence pack; the range is $2,500–$5,000 per review; $2,000–$10,000 per evidence pack. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-045 — Approval-Gated Remediation Review PILOT
A bounded pilot report: up to five scenarios, the relevant library engine or analysis, a written result and the stated limits. Engineering time is quoted per pilot.
Kind: Retainer · Price (proposal): $2,500–$5,000 per review · Lead time: 10 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.