Written by: Nimesh Chakravarthi, Co-founder & CTO, Struct
Key Takeaways
- Agentic on-call MTTR reduction uses AI agents to compress 45-minute manual triage into 5-minute investigations by running the observe-reason-guide-verify loop.
- Teams using Struct report 80% triage-time reduction, 2,100+ automated investigations monthly, and 56 engineer-hours reclaimed per month.
- The observe-reason-guide-verify loop parallelizes work across observability tools, correlates signals into cited root-cause hypotheses, and surfaces fixes in Slack before engineers engage.
- Incident resolution verification confirms fixes against live observability data, which removes the green-dashboard problem and reduces false closures.
- Struct delivers senior-SRE-quality investigations in under 10 minutes of setup so lean teams can handle production incidents with confidence.
Agentic on-call MTTR reduction in today’s reliability stack
Agentic on-call MTTR reduction means deploying AI agents that autonomously gather telemetry, reason over it, guide engineers to a fix, and verify resolution, which compresses the investigation phase that accounts for 60–80% of total incident time in production systems. Enterprises using AI-driven observability and automated triage often report measurable MTTR reductions, with the largest gains concentrated in triage and diagnosis. Industry data shows these improvements across large environments.
Traditional on-call workflows force engineers to manually correlate signals across disconnected tools. The Catchpoint SRE Report 2025 found that nearly 70% of SREs say on-call stress has contributed to burnout and attrition, while time spent on operations continues to rise. The Splunk State of Observability 2025 survey reports that many teams spend too much time responding to alerts, and 73% have experienced outages caused by ignored or suppressed alerts.
Agentic systems change this pattern by running incidents through a structured pipeline. Industry practice breaks the lifecycle into five stages: detection via event-driven triggers, triage with alert deduplication and cross-service correlation, investigation that pulls logs, metrics, and traces, remediation proposals with rationale, and human escalation for high-risk decisions. Struct implements this pipeline as the observe-reason-guide-verify loop, which sits on top of existing observability tools instead of replacing them.
See Struct run the observe-reason-guide-verify loop in your own environment and compare it to your current on-call workflow.
How the observe-reason-guide-verify loop cuts triage to under 5 minutes
The observe-reason-guide-verify loop is the core mechanism that delivers agentic MTTR reduction. It cuts triage time by parallelizing work that engineers previously performed sequentially and manually. Struct customers working at large scale with many services report an 80% reduction in triage time, which turns 45-minute investigations into 5-minute reviews. Arcana runs 2,100+ automated investigations per month while maintaining an over-80% helpful investigation rate.
Each phase of the loop has a clear job:
- Observe: Struct listens to alert channels in Slack or PagerDuty and immediately queries connected observability sources such as Datadog, Sentry, AWS CloudWatch, GCP Logs, and GitHub the moment an alert fires.
- Reason: The agent correlates logs, traces, metrics, and deploy history into a unified timeline and forms a cited root-cause hypothesis. Struct ingests Sentry issues and correlates them with Datadog metrics, cloud infrastructure, GitHub deploy history, logs, and traces to produce a cited root-cause hypothesis.
- Guide: A dynamically generated dashboard surfaces blast radius, affected users, supporting evidence, and suggested fixes directly in Slack before the engineer opens their laptop.
- Verify: Struct’s Incident Tracker runs an approximately 1-minute automated verification loop against observability data to confirm that an incident is actually resolved, not just closed.
AI agents can reduce triage-to-root-cause time by dispatching multiple investigation subagents in parallel across Kubernetes, metrics, logs, and traces. Struct applies the same parallel approach within a single composable investigation layer so engineers receive a complete picture instead of a stack of raw alerts.
Watch the full observe-reason-guide-verify loop run on your next alert and compare the investigation time to your current baseline.
Incident resolution verification that checks real user impact
Incident resolution verification uses automation to confirm that an incident is genuinely resolved by re-querying the same observability data used during detection, instead of simply marking a ticket closed. Without this step, teams face the green-dashboard problem. Dashboards can show healthy metrics, logs, and traces even when users experience failures due to DNS issues, TLS errors, network routing problems, or regional outages that prevent requests from reaching the system. Struct’s Incident Tracker addresses this risk with a ~1-minute automated verification loop that checks observability data before it marks an incident resolved.
The following table maps KPIs to each stage of the incident lifecycle and shows what Struct measures and what improvement teams can expect:
| Incident Stage | Primary KPI | Baseline (Manual) | With Struct |
|---|---|---|---|
| Alert Receipt | Mean Time to Acknowledge (MTTA) | Target: under 5 min for P0, often exceeded manually | Immediate: investigation starts when the alert fires |
| Triage | Engineer minutes per investigation | 10–45 minutes (Arcana baseline) | 2 minutes median (Arcana post-Struct) |
| Remediation | Automation success rate | Target: 95%+ for automated runs | Over 80% helpful investigation rate across 2,500+ runs |
| Verification | Ticket reopen rate / false closure rate | Manual re-check required, often skipped | ~1-minute automated loop via Incident Tracker against live observability data |
Deploy Guard extends verification upstream. It reviews instrumentation at the pull request stage, suggests alerts, and runs post-deploy health checks, which catches alerting gaps before they become incidents. Closed-loop verification rechecks the same signals used during detection and compares current conditions against a validated baseline to confirm that the correction produced the intended state without unintended consequences.
Add incident resolution verification to your existing observability stack and reduce false closures on your next on-call rotation.
L0–L5 autonomy levels, blast-radius limits, and safe L3 use cases
Progressive autonomy frameworks define how much authority an AI agent holds at each stage, which actions require human approval, and how the system demotes itself when error rates rise. The governance framework in arXiv:2607.23438 by Haining Zheng et al. separates Allowed Autonomy Levels (AAL), the degree of autonomy an agent is authorized to exercise given risk and accountability, from Autonomous Capability Levels (ACL), which characterize inherent technical ability. A high-capability agent can be deliberately constrained to a lower allowed level based on blast-radius risk. Microsoft Azure Networking’s production deployment enforces four safety principles, least privilege, blast-radius containment, reversibility, and progressive trust, through layered authorization and automatic demotion when failure rates exceed thresholds.
| Level | Label | Agent Authority | Blast-Radius Limit & Safe Examples |
|---|---|---|---|
| L0 | Read-Only / Observe | Queries telemetry, no writes | Zero production impact, safe for all alert types. Example: pulling logs and summarizing error rates. |
| L1 | Advisory | Generates root-cause hypotheses and suggested fixes, human decides and executes | Zero production impact. Example: Struct’s automated investigation dashboard posted to Slack. |
| L2 | Supervised Action | Executes low-risk actions autonomously, escalates above a defined threshold | Bounded to reversible changes. Safe examples include certificate rotations, load balancer reconfigurations, and disk cleanup where failure signatures are unambiguous. |
| L3 | Goal-Directed Autonomy | Executes bounded remediation automatically, humans monitor and intervene on thresholds | Requires topology-based blast-radius calculation and multi-level rollback. Safe examples include auto-scaling a service tier and restarting a known-flapping pod with a confirmed rollback plan. |
| L4 | Delegated Operational Authority | Handles end-to-end resolution including cross-service changes, human approval for irreversible actions | High-risk gate required. Rollback autonomy depends on a clear temporal link between deployment event and failure onset. |
| L5 | Self-Improving | Updates runbooks and playbooks from incident outcomes and refines alert thresholds autonomously | Google SRE AI agents continuously monitor and improve runbooks based on incident usage. This level requires strong identity, explainability, and continuous evaluation against a quality framework. |
Struct operates at L1–L2 for most teams. It delivers fully automated investigation and advisory output, with optional handoff to a coding agent or PR creation for remediation. This approach keeps blast radius at zero for the investigation phase while preserving the 80% triage-time reduction that engineering leaders need.
Configure the autonomy level that matches your team’s risk tolerance and keep control over which actions remain human-only.
KPI stack for every incident stage
Measuring agentic on-call MTTR reduction requires tracking KPIs at each stage of the incident lifecycle, not just the final resolution timestamp. One organization initially saw only a 14% MTTR improvement after AI deployment because the system could diagnose but not execute fixes, required multi-team approvals, and used outdated runbooks. After integrating AI with infrastructure-as-code for auto-remediation and rebuilding runbooks, MTTR fell 79% from baseline. Tracking resolution quality alongside speed separates teams that sustain gains from those that plateau.
Struct’s impact on Arcana’s KPI stack shows what this improvement looks like in practice:
- Investigations per month: 2,100+ automated investigations monthly.
- Engineer-hours reclaimed: 56 engineer-hours per month, with senior engineer investigation hours dropping from approximately 60 to approximately 4.
- Median investigation time: 30 minutes to 2 minutes.
- Helpful investigation rate: Over 80% across 2,500+ runs.
- Triage time reduction: The 80% improvement noted earlier across large-scale customers.
Standard on-call KPIs to track alongside these include MTTA (target under 5 minutes for P0), false positive rate (target below 10%), alert noise ratio (target below 3 alerts per unique incident), and automation success rate (target 95%+). Teams using AIOps-driven alert correlation typically see alert volume drop by 60–80% without loss of incident coverage.
Establish your baseline KPIs with Struct before your next on-call rotation so you can measure real MTTR impact.
How Struct supports lean teams with investigation and verification
Struct is built for engineering teams of 15–80 engineers who need investigation quality equivalent to a senior SRE without adding headcount. Setup takes under 10 minutes. You authenticate Slack or PagerDuty as the alert source, connect GitHub for code context, and link observability tools such as Datadog, Sentry, CloudWatch, GCP Logs, Grafana, or others. From that point, every configured alert triggers an automated investigation before an engineer opens their laptop.
Two capabilities complete the closed loop for lean teams by covering both upstream and downstream stages:
- Deploy Guard: Reviews instrumentation at the PR stage, suggests appropriate alerts, and runs post-deploy health checks, which improves alerting quality before incidents occur rather than after.
- Incident Tracker: Keeps incident status current automatically and runs a ~1-minute verification loop against live observability data to confirm resolution. Together, Deploy Guard prevents incidents upstream while Incident Tracker verifies resolution downstream, which creates a complete feedback loop.
Struct does not replace Datadog, Sentry, Grafana, or any existing observability tool. It sits on top of them as an investigation and verification layer. Arcana reduced senior engineer hours on investigation from approximately 60 to approximately 4 per month after adding Struct on top of Datadog. The observability data remained in Datadog, while Struct provided the reasoning and verification layer above it.
For junior engineers and new hires, Struct encodes team-specific runbooks so every alert produces a contextualized starting point. This approach makes it safe to expand on-call coverage beyond the two or three senior engineers who hold tribal knowledge. That capability becomes a critical scaling lever for Series A–C teams under SLA pressure.
Struct is SOC 2 Type II and HIPAA compliant, with logs accessed and processed ephemerally. A 30-day risk-free pilot is included with every plan.
Get Struct running on your stack in under 10 minutes and see incident resolution verification in production.
Frequently Asked Questions
Does Struct replace our existing observability tools like Datadog or Sentry?
Struct does not replace your observability tools. It acts as an investigation and verification layer that sits on top of them. Struct queries Datadog, Sentry, AWS CloudWatch, GCP Logs, Grafana, Prometheus, and others to pull the telemetry it needs for root-cause analysis. Your dashboards, alerts, and data remain in your existing tools. Struct adds the reasoning, correlation, and closed-loop verification that those tools do not perform automatically.
How long does setup take, and does it require dedicated engineering time?
Setup takes under 10 minutes. You authenticate three connections: your alert source such as Slack or PagerDuty, your code repository such as GitHub, and your observability context such as Datadog or cloud logs. Once connected, auto-investigations activate immediately. You do not need a dedicated engineering sprint, a professional services engagement, or weeks of indexing.
Is our data secure? We handle sensitive financial data.
Struct is SOC 2 Type II and HIPAA compliant, with compliance documentation available at trust.struct.ai. Logs are accessed and processed ephemerally, and Struct does not store them beyond the investigation window. For most Series A–C fintech and B2B SaaS companies, this compliance posture meets standard requirements. If your organization requires full on-premise deployment with zero data leaving your VPC, Struct is not currently the right fit because the platform requires access to your logs and observability context via its integrations to function.
What if our logging and alerting setup is immature?
Struct relies on the telemetry you provide. Teams already using Sentry for exceptions, Datadog or cloud logs for infrastructure telemetry, and Slack for alert routing get the most value immediately. If your system lacks basic logging, trace IDs, or alert triggers, the investigation quality will reflect those gaps. Deploy Guard, launched August 3, 2026, helps address this upstream by reviewing instrumentation at the PR stage and suggesting appropriate alerts before incidents occur, which makes it a useful starting point for teams improving their observability posture.
Can we customize how Struct investigates our specific error types and services?
Struct supports custom runbooks, correlation ID formats, and composable widgets that guarantee specific data is always pulled for defined alert types. You can paste your team’s existing on-call runbook directly into Struct, and the agent will follow those operational procedures when a matching alert fires. This is how teams encode tribal knowledge so that junior engineers receive the same contextualized starting point a senior engineer would produce manually.
Recap and next steps for adopting agentic on-call
The observe-reason-guide-verify loop provides the operational framework that turns agentic on-call MTTR reduction from a concept into a measurable outcome. Observe means the agent queries all connected telemetry the moment an alert fires. Reason means it correlates logs, traces, metrics, and deploy history into a cited root-cause hypothesis. Guide means it surfaces blast radius, affected users, and suggested fixes in Slack before the engineer engages. Verify means Struct’s Incident Tracker confirms resolution against live observability data instead of accepting a manual close.
For teams evaluating whether this workflow fits their environment, a structured audit offers the most practical starting point to establish a baseline:
- Review your current on-call workflow and measure actual engineer minutes per investigation across the last 30 days.
- Audit your runbooks and identify which alert types have documented procedures and which rely on individual tribal knowledge.
- Assess telemetry quality and confirm that Sentry, Datadog or cloud logs, and GitHub are connected and producing clean signals.
- Identify process gaps and determine which incident stages, triage, remediation, or verification, consume the most unplanned engineer time.
- Define your baseline KPIs such as MTTA, engineer-minutes per investigation, and false positive rate before deploying any automation so improvement is measurable.
Once you complete this audit, you can deploy Struct against a clear baseline and track the impact of the observe-reason-guide-verify loop. The 30-day pilot lets you validate investigation quality, triage-time reduction, and resolution verification on your real incident volume before you commit.
Connect your stack to Struct in under 10 minutes and let it handle your next investigation end to end.
