Operational insight without unrestricted production access.

What the model can do

The model can select bounded investigation tools, summarize returned evidence, and prepare typed remediation plans. It cannot directly call infrastructure adapters, access a shell, or bypass policy evaluation.

• No arbitrary shell execution
• No direct model-to-cloud access
• No Kubernetes Secret values
• No silent mutation without policy evaluation

What the executor can do

A restricted executor uses a separate authenticated identity. Every mutation is typed, scope-checked, idempotent, persisted, and auditable. Generic Kubernetes operations require explicit administrator confirmation.

• Environment and resource scope are checked
• Actions carry an idempotency key
• Execution receipts are persisted
• Recovery behavior is verified

Privacy boundary

Raw traces, logs, and metrics remain in SigNoz. Tracey’s default model boundary excludes prompts, model responses, tool arguments and results, credentials, tokens, personal data, Kubernetes Secret values, and raw private application content.

Tracey stores registrations, investigations, policies, notifications, action history, executor receipts, and bounded semantic summaries in PostgreSQL with pgvector.

Identity and connector hygiene

Use separate least-privilege identities for investigation and execution. Test connector permissions, monitor readiness, and disable or remove integrations without exposing stored secrets in the browser.