Alert

Monitoring alerts are informal and undocumented. Someone set up a cron job that emails the team when disk usage hits 90%, and there's a Slack bot that pings when the API is slow — but nobody documented what alerts exist, what they mean, or who should respond to them. 'Are we monitoring the payment service?' 'I think so — check with the person who set it up.' Alert knowledge lives entirely in the heads of whoever configured the monitoring tools.

None — AI cannot reason about alerts because no documentation of alert definitions, thresholds, or response procedures exists in any accessible system.

Some alerts are documented but coverage is spotty. A wiki page lists the critical production alerts but omits staging alerts, informational notifications, and alerts that individuals configured in their personal monitoring dashboards. Alert severity definitions vary — what Datadog calls 'critical' doesn't match what PagerDuty calls 'P1.' There's partial documentation but you can't trust it as a complete picture of what's being monitored.

AI can read the partial alert documentation but cannot assess monitoring coverage because the catalog is incomplete. Cannot rationalize alert severity across monitoring tools because severity definitions are inconsistent.

Alerts are documented using a consistent template covering trigger condition, severity, affected service, escalation path, and linked runbook. The operations team maintains an alert catalog that is reviewed when new services launch. The documentation is thorough and findable. But it's stored in wiki pages — an AI agent can read about individual alerts but can't programmatically query 'show me all critical alerts for the payment service that have fired more than 10 times this month.'

AI can search and read alert documentation to understand individual alert definitions and response procedures. Cannot perform cross-alert analysis or automated coverage audits because the documentation format is human-readable narrative rather than structured, queryable records.

Every alert is formally defined as code with typed fields — trigger condition, severity, affected service ID, escalation policy, runbook reference, and SLO linkage. Alert definitions live in version control alongside the services they monitor. An operations engineer can query 'show me all alerts for the checkout service, their SLO linkage, and their fire frequency over the last 30 days' and get a precise, programmatic answer.

AI can query alert definitions programmatically, correlate alerts with service SLOs, identify coverage gaps, and detect alert fatigue patterns. Cannot yet autonomously tune alert thresholds because optimal thresholds require understanding business context and acceptable risk tolerance.

Alerts are modeled as a formal monitoring ontology with typed entities and validated relationships. Each alert links to the service it monitors, the SLO it guards, the escalation chain it triggers, and the correlated alerts it may suppress or be suppressed by. An AI agent can answer 'if we add a new microservice to the checkout flow, what monitoring gaps exist and what alert definitions should we create based on our established patterns?' by querying the ontology.

AI can autonomously generate alert definitions for new services based on the monitoring ontology, recommend threshold adjustments based on historical fire patterns, and identify redundant or conflicting alerts. Human judgment is needed for defining acceptable risk levels and SLO targets.

Alerts are self-documenting. When a new service is deployed, the monitoring system automatically generates baseline alert definitions from observed behavior patterns. When service behavior changes, alert thresholds auto-adjust and the documentation updates. The alert catalog evolves in real time as the system evolves, eliminating documentation lag. Alert definitions are generated from live service behavior rather than manually authored and maintained.

Can autonomously maintain a complete, current alert catalog that evolves with the services it monitors, generating, tuning, and documenting alert definitions without human intervention.

Ceiling of the CMC framework for this dimension.