DC Ops Triage
An AI-assisted triage pipeline for data center incidents. Policy code makes the calls an auditor needs to trust, Claude writes the handover, a human approves what leaves the system, and every step lands in a tamper-evident evidence ledger mapped to SOC 2, ISO 27001 and FedRAMP controls.
Capable teams, manual pipes
The Senior Manager, Infrastructure Operations and Compliance role covers 24x7 incident response and continuous audit readiness across 750+ sites. The posting is direct about where the toil is, and this project takes aim at two of the named targets: incident triage and compliance evidence generation.
"operationally capable but structurally manual"Who you are
"identifying and prioritizing automation opportunities in access reviews, decommissioning evidence collection, portal data extraction, and incident triage"Automation & Operational Efficiency
"maintain audit readiness continuously, not just at cycle time"Position overview
npm run demo
One queue, every decision explained
Pick an incident. Severity, owner, shift, SLA clock, escalations and controls all come from the policy rules, and each carries its reason. Notes here are the demo's template notes, because it ran without an API key; with one, Claude writes them (see the example after the board).
Running live in Cloudflare OS
The same Gatekeeper, deployed as a Worker into a self-hosted Cloudflare OS. A Claude Sonnet 5.5 agent read the incidents through it, wrote the triage note for the Frankfurt UPS incident, and the filing stopped for a human to approve. Screenshots from the live run.
My prompt: “List open incidents most severe first, then triage INC-24101: read it, write a triage note, and file it.”
The note, and the attack it ignored
The carrier email for INC-24103 ends with an injected instruction. The alert is fenced as untrusted data, the note format has no severity field, and the policy rates it SEV2 regardless.
Where each decision lives
Try to change the record
These are the 21 records the demo wrote. On load, this page recomputes every SHA-256 hash with your browser's own crypto. Quietly downgrade the Frankfurt power incident from SEV1 to SEV4 in record 8, and watch verification fail at that exact record.
| seq | incident | event | actor | prev hash | hash |
|---|
Guardrails an auditor can follow
Rules decide, AI writes
Severity drives paging, SLAs and regulatory clocks, so it comes from short, reviewable code. Claude does what it is good at: reading messy vendor text and writing a clear handover.
Untrusted input stays data
Alert text is fenced and labelled as data in the prompt. Output must match a strict format or it is rejected. A test proves a model-supplied severity is dropped.
Humans approve, agents keep moving
Posting and filing go through the Cloudflare OS approval queue. The Gatekeeper simulates pending filings, so the agent finishes the queue and the lead approves in one pass.
Fails safe
If the model is down or returns junk, a labelled template note is used, the error is written to evidence, and the rule-based triage is unaffected.
Prove it, then widen it
- Shadow mode, one regionAgent drafts notes; engineers compare against their own triage for two weeks. Tune thresholds with the shift leads. Measure baseline minutes per triage and MTTA.
- Filing with approval for SEV3–4Lower-risk incidents go through the approval queue first. Track SLA attainment by shift and region from the ledger.
- All severities, all shiftsAPAC, EMEA and NASA on one queue and one evidence trail. GRC reviews the control mapping.
- Decommissioning chain of custodySame pattern from "decom triggered" through unracking, ITAD destruction, certificate of destruction and serial verification to "evidence archived", closing the Maintain-to-DCSC handoff gap.
- Physical access reviewsAgent pre-compares colo access lists with HR status and approved tickets for MAR/QAR cycles; reviewers approve exceptions in bulk.
Run it yourself
The Gatekeeper is a drop-in for the example in cloudflare-os-starter and type-checks against Cloudflare OS's own Gatekeeper, GatekeeperUser and ApprovalQueue interfaces. The demo needs nothing but Node.