One layer of engineering judgment over production change.
Before a change ships, ChangeGuard AI judges it against the environment it will actually enter — SHIP, HOLD or BLOCK, with the reasons. After it deploys, it observes what happened and writes the outcome into the same record. When something goes wrong it proposes the fix within the authority you grant — advisory unless you say otherwise. Start with nothing connected: Preflight works on its own, and gets sharper as you connect an environment and GitHub.
Four decisions teams make about production change
One layer of engineering judgment, organized here by the job you’re trying to do — not by feature. Every capability is labeled by maturity.
| The job you have | Capabilities that serve it |
|---|---|
| Decide what’s safe to ship | CSC Score & pre-flight GA · Engineering Advisor Early Access |
| Know what broke, and why | Change Intelligence GA · Incident investigation GA · Current Understanding GA where enabled |
| Recover without guessing | Verified Remediation GA · opt-in |
| Trust it in production | Security posture, RBAC & the autonomy model GA |
Each capability, with the detail — and its maturity label
The same capabilities from the table above, explained. We label every one GA or Early Access and never market an emerging one as if it ships today.
Change History & Attribution
A continuously-updated record of every deployment, config, and GitOps change across your fleet — and, crucially, the link from each failing workload back to the exact change that shipped it, with the diff.
- Change timeline per cluster, from your CI and GitOps (ArgoCD / Flux)
- Failing workload → commit + diff that shipped it
- The substrate everything else reasons over
Incident investigation
Detect a failing workload, explain the root cause with cited evidence, propose a fix, and state how to verify it — automatically, the moment the incident is detected.
- Root cause with confidence and cited evidence
- Proposed fix (code patch or manifest change) and explicit verify criteria
- Append-only activity timeline on every incident
The judgment layer
A deterministic verdict you can trust — and the capabilities that turn it into the read a senior engineer would give.
Preflight — SHIP / HOLD / BLOCK
Judge a proposed change against the live environment it will enter: a verdict with its reasons, an honest list of the evidence it had and did not have, and a permanent change record that later carries what actually happened. Advisory by default — in GitHub a BLOCK fails the pull-request check only if you require the check.
Current Understanding
The maintained, change-centric read of an incident — what a newcomer needs to know right now, not a log of everything that ever happened.
Engineering Advisor
The teammate that remembers every production change. The one or two things a senior engineer would raise before a change proceeds — led by what’s true right now, challengeable, and honest about what it can’t see. Read the full Advisor page →
Engineering Opinion & Reasoning
ChangeGuard AI’s owned position on an incident — belief, confidence, tradeoffs, and honest ✓/⚠ factors — with the reasoning shown, not hidden.
Institutional Engineering Memory
Engineering Experience: what similar past incidents and changes actually did — real counts, real outcomes — woven in only when it changes the decision.
Multiplayer Collaboration
A shared incident workspace so the whole team works from one current understanding instead of re-deriving it in five threads — with ChangeGuard AI as a participant, not a chatbot.
Verified Remediation
A closed loop — detect, diagnose, execute within policy, verify, roll back — governed entirely by autonomy levels you set. Off by default; it starts in Advise and never acts beyond the level you choose.
Observe
Watch and record. No recommendations surfaced to act on.
Advise default
Recommend fixes. Nothing executes.
Approve
Act only after a human approves each action.
Auto
Act automatically, but only inside an explicit execution policy: allowed namespaces, fix types, a confidence floor, and an hourly cap.
Every applied fix is verified against real workload health. If it fails verification, ChangeGuard AI performs exactly one audited rollback and hands the incident to a human. See the autonomy & safety docs →
Security & Trust
Posture scanning
CIS benchmarks (KubeBench), image CVEs (Grype), deprecated APIs (Pluto), SBOM (Syft), and runtime threat detection (Falco) — feeding the CSC Score.
Identity & access
RBAC analysis, over-privileged identity detection, and a privilege-escalation / attack-path graph.
Compliance mapping
Maps scan, RBAC, and SBOM evidence to framework controls (SOC 2, PCI, HIPAA, and more) and exports it as CSV/JSON. ChangeGuard AI helps you evidence controls — it is not a certification.
Try it on your own cluster
Judge a change by hand in minutes with nothing connected. Connect an environment for live context and GitHub for a verdict on every pull request. Advisory by default.