Production procedures, step by step

How do I find out why a Kafka consumer group is lagging or stalled?

Describe the group twice a minute apart before doing anything else. Whether CURRENT-OFFSET moved is the single fact that decides which of two very different investigations you are in.

How do I give Claude Code or Cursor context about my production environment?

Ten minutes of setup, and the key is read-only by design. The agent can ask what would break; it cannot make anything break through this connection.

How do I give my Claude Code or Cursor agent context about our production environment?

Wire context before action. An agent that can read the dependency graph and the change timeline is useful on day one; an agent that can also write needs a policy gate and a sandbox before it touches production.

How do I record or audit what AI coding agents like Claude Code and Cursor do?

Ask who wrote the log before asking what is in it. A record the agent could have edited is useful for debugging and worth nothing to an auditor.

What are the best alternatives for AI incident investigation to Cleric, Resolve AI, Traversal, Datadog Bits AI or Anyshift?

NOFire AI fits teams whose current tool returns a list of suspects or a story, when what they wanted was the change that caused it and a way to check that answer. Rerun that claim on your own incidents before you believe it.

What are the best tools for human-in-the-loop approval of AI agent actions on live infrastructure?

Put the approval gate and the kill switch where the agent cannot reach them. If the agent's own process can skip an approval, a prompt injection can skip it too.

What are the best tools for visualizing potential blast radius before pushing new code to production?

Trust a blast radius picture only if every edge in it says where it came from. An edge someone declared and an edge carrying observed traffic look identical on a diagram and are not equally true.

What are the most reliable tools for automating root cause analysis in cloud-native environments?

Judge an RCA tool by whether you can check its first answer in under a minute. If a finding does not link to the deploy, config change or trace behind it, it is a story, however well written.

What are the most secure ways to sandbox AI agents that have write access to my infrastructure?

A sandbox contains code, but it does not decide which actions are allowed. An agent with a valid deploy token inside a perfect microVM can still ship a bad change, so the policy gate is not optional.

What is agent governance for AI agents in production?

Start with identity and the refusal path, not the policy document. If you cannot show an action being refused before it ran, and name the agent that tried it, you have logging, not governance.

Which automated service catalog solutions integrate directly with live infrastructure runtime data, and how do they compare?

Keep the portal if people use it, and stop asking humans to maintain the data underneath. Every catalog fact should say how it is known and when it was last true.