Perplexity Publishes an AI Incident-Response Recipe With Read-Only Guardrails

Perplexity has published a cookbook for an AI agent that can investigate a production incident across Datadog and GitHub, then deliver a status update to Slack. The notable constraint is that the example is built to inspect evidence and recommend a response, not change code, alter monitoring, or execute a rollback.

The guide assembles an Incident Responder Profile from a tool-capable Agent API model, instructions, Sandbox, an incident-response Skill, and managed connectors for Datadog, GitHub, and Slack. Project administrators create and save those resources in Perplexity’s API Portal; project members can then launch the configured agent through the Agent API.

The division of work is specific. Datadog provides incident details, monitor state, and logs. GitHub provides the service repository and deployment comparison. Slack is only the delivery destination for the completed update, not an investigation source. The run is billable, with cost and duration depending on the selected model, step limit, and connector calls.

Most connectors expose a fixed set of tools that an agent calls individually. Perplexity’s guide says pairing GitHub with Sandbox instead makes the connected GitHub credential available to command-line tools in the container. That lets the agent clone a repository, find release tags, and run a diff between the prior release and the deployment named in an incident without placing a GitHub token in application code.

That changes the agent from a monitoring-summary tool into one that can compare a live failure signature with the exact code changes in a named deployment. But the cookbook explicitly treats a matching code diff as a supported inference, not a confirmed root cause, and requires the agent to record observations, inferences, and unknowns separately.

Guardrails sit in configuration, not in the Profile alone

The guide narrows Datadog to incident retrieval and searches of logs and monitors, and narrows Slack to sending messages. The example sets a maximum of 30 agent steps. It also instructs the agent to treat connector results and code comments as untrusted evidence rather than instructions, build a timestamped evidence ledger, and avoid claiming that a mitigation worked without a post-change measurement.

Still, Perplexity says a Profile is a reusable configuration rather than an authorization boundary. A request can override fields from the saved Profile, while a connector supplied in a request replaces a Profile connector with the same ID. The guide therefore recommends pinning production traffic to a specific Profile version and keeping requests limited to the profile, input, and background fields.

Managed connectors remain in preview. The cookbook offers a concrete pattern for making incident investigation reusable: an administrator defines the model, tools, credentials, instructions, and version once, while a member supplies the incident, repository, deployment tag, and Slack destination at run time. Its unresolved practical question is whether teams can preserve those written limits when they adapt the template to their own systems and permissions.