What does an agentic architecture for automated RCA have?

When engineers adopt new AI tools to help them get to the root cause for alerts and incidents, the model gets most of the discussion. Which lab, which release, and which context window. Then two teams use the same model and get completely different results.

The model is central to the investigation, but it is the architecture around the model that allows it to understand, learn, and act on any alert. Without the harness, the context, the tools, the reasoning, the learning, and the evaluations, general purpose models are not adept at navigating internal production environments.

For automated RCA, the harness matters as much as the model inside it.

Key facts

• An agentic harness is everything around the model that makes it a working investigator: context, tools, reasoning structure, guardrails, a learning loop, and evals.
• Two agents on the same model produce very different investigations. The harness is where the difference comes from.
• A framework gives you generic plumbing. You still have to build the six layers of a production harness on top of it.
• A good harness absorbs new model releases through evals instead of being rebuilt around each one.

What an agentic harness means for automated RCA

An agentic harness is the system built around a model to turn it into a working agent. For automated root cause analysis, the harness is six layers working together:

• Models. The LLMs do the work and are orchestrated per task, with cheap models for volume and the strongest models for synthesis.
• Context. A context graph of your services, dependencies, and changes, plus context engineering that keeps what the model sees scoped and relevant.
• Reasoning. Causal reasoning with hypotheses pursued in parallel and tested against evidence, so the investigation converges on a checked answer instead of a first guess.
• Actions. Guardrails and scoped autonomy, so the agent investigates freely and acts only within explicit bounds, with an audit trail on everything.
• Learning. Feedback and memory, so every investigation improves what the system knows about your environment.
• Evals. A domain-specialized eval framework that measures investigation quality and gates every change before it ships.

This is Resolve AI's published architecture: the agents on top and the enterprise platform, integrations, security, audit, and deployments underneath.

How a harness turns a coherent answer into a correct one

A checkout latency alert lands on an agent with no harness. The agent pulls recent logs from the alerting service, recognizes a familiar pattern, and writes a paragraph blaming elevated database load, with a recommendation to investigate the database. It sounds right. 

But that is all that can be said. Without the reasoning and the context and the guardrails and the evals, an engineer can’t tell the difference between a coherent answer and a correct one. WIthout the harness, nothing gave the agent a way to look upstream, and nothing it did left a trail an engineer can verify.

Inside a production harness, the same alert goes differently, because the architecture works with the model:

• The context layer supplies context for the investigation, not just the alert: checkout's dependencies and current state, recent changes across the environment, operating knowledge like known noise, and the last confirmed cause for this alert class. What gets pulled shifts with each step of the investigation.
• Instead of one guess, several hypotheses get investigated at once, one agent starting from the deploy history, another from the alerting service, another from the dependency graph.
• Each line of investigation runs scoped queries in the right tools, and each result rules candidates in or out.
• The surviving explanation gets checked as a chain, the deploy touched the code path, the timing fits, and a verifier model reviews the reasoning before anyone sees it.
• The engineer receives a causal timeline with the evidence attached, every query logged.

The answer at the end is still a cause, but with the evidence attached, the alternatives ruled out, and every step logged, an engineer can verify it instead of taking it on trust.

How the layers work together

An investigation flows through the layers in order, with feedback for learning.

The forward path is the investigation. Context gives reasoning the graph of your systems and their current state, how they behave and how they fail. The models run each task inside that context graph, and the conclusion that survives verification goes to the actions layer, where the proposed fix waits for an engineer.

The loops are what make the system improve. Learning writes what each investigation found back into the context layer, so the context graph gets more accurate with use. Evals sit across everything as the measurement. They keep the best model on each job as new releases land, score whether reasoning chains hold, and catch learnings that no longer hold.

Remove one layer, and the others degrade. Reasoning without context is guessing across an unmapped system. Models without evals drift with every release. Learning without verification writes unchecked conclusions into the record. Each layer depends on the others, which is why the harness has to be built as one system.

The release cycle shows the same dependence. With a thin wrapper, the product is whatever the wrapped model does, so every release changes the product in ways nobody chose. With a real harness, a release is a candidate. It gets tested against investigation evals, adopted for the tasks where it wins, and rejected where it regresses.

Resolve AI benchmarked Claude Sonnet 4.6 on production investigations within days of its release. That's what the process looks like from the outside.

Why DIY approaches fall short for automated RCA

A DIY route can produces a real harness. A prompt plus LangChain plus connections to a few tools is good starting point for a harness, and will handle simple single-service failures well enough to impress.

What the minimal harness lacks is the six layers' content. The framework brings tool calling, control loops, memory primitives, and retries. But it will still be missing a model of your systems, production failure knowledge, investigation evals, guardrails tuned to production actions, or a learning loop. No prompt can add those. Instructions only change how the model uses what it already has.

So each layer becomes its own project:

• A system model that stays current.
• Models that know the domain.
• Reasoning that runs in parallel and gets verified.
• Guardrails that satisfy a security review.
• A learning loop.
• An eval platform built from labeled incidents.

Teams that start down this path discover they're building an internal product, which is the honest version of the build-versus-buy question.

Automated RCA is an investigation method run by software. A production harness automates the method itself, generating hypotheses, choosing the evidence that separates them, and eliminating alternatives until the cause is found. DIY efforts plateau exactly there, on the method.

How to evaluate the harness behind an automated RCA tool

• How is the investigation structured? One thread or parallel hypotheses, and is the conclusion verified before an engineer sees it?
• What can it touch, and what stops it from touching more?
• Does it improve from our incidents?
• How is investigation quality measured, and how do new model releases land?

Most vendors lead with the model. Ask about the harness instead, because that's where the products actually differ.

How Resolve AI builds the harness

The six-pillar architecture this page describes is Resolve AI's published design, with domain-specialized agents on top and an enterprise platform, integrations, security, audit, and deployment options, underneath. The architecture keeps evolving on purpose, absorbing each model release and capability as it lands, so investigations stay at frontier quality without anything on your side being rebuilt.

The results hold up in production. DoorDash Ads reduced time to root cause by up to 87% with Resolve AI, and Salesforce reduced it by roughly 60%. Book a demo to see the whole harness working on your own stack.