AI Incident Management
All Quiet provides AI incident management as an incident management platform your very own agents can operate. It's not a chatbot sitting on your incident data. Every user on the All Quiet platform gets scoped API keys and personal access tokens, so an agent can create incidents, read on-call, and configure integrations under least privilege. A personal access token can never do more than the actual person it belongs to.
What paged us overnight? Cover Alex's shift until noon.
3 critical incidents overnight. You're on-call until 12:00 — override created.
Trusted by
From ClickOps to Agents
Developer tools are moving from ClickOps and click UIs to APIs, then to agents. Terraform was the first step: machine-to-machine provisioning, usually with an admin-level key. Agents are different. They act as a specific person, often an on-call engineer, not as the whole org. That only works if the API key can match that person's permissions. Giving every user a scoped token, not just the admins, is the foundation.
Operate everything via API
The public API covers incidents, teams, escalations, on-call, overrides, inbound and outbound integrations, status pages, routing rules, and audit logs. Each resource has its own scopes: get, list, create, update, delete. An agent can search last night's incidents, check who is on-call, create an override, or list the payloads that hit an integration. Terraform owns the config. Agents run the day-to-day work.
For on-call, alerting, status pages, and reporting, see our incident management platform overview.
Datadog alerts look off — pull the last three payloads and tell me if our mapping would create the right severity.
Latest payload maps alert_priority → severity, but the field is nested under tags in two of three samples. Mapping would emit Minor instead of Critical — JSONPath should be $.alert_priority, not $.tags.priority.
Excellent, now let's remove me from the weekend's on-call.
PATCH …/team/escalations — not in PAT scope (mappings: update omitted). Escalation blocked; token is read-only on mappings.
Clear guardrails for your agents
Agents can go off-script. To use them in production you need a harness: scopes per resource, optional team and org allowlists, expiry, and IP filters. Use organization API keys for pipelines and Terraform. Use personal access tokens when an engineer wants an agent that acts as them, not only when they have admin.
Effective access is the intersection of the token's scopes and the user's live roles. If the person cannot do it in the UI, the agent cannot do it either, even if it asks. Out-of-scope calls return 403. Creates, updates, and deletes of auditable resources land in the audit log, attributed to the key.
API key authentication guide| Resource | get | list | create | update | delete |
|---|---|---|---|---|---|
| incidents | — | ||||
| on-call-overrides | — | — | |||
| inbound-integration-payloads | — | — | — | ||
| teams | — | — | |||
| users | — | — | — | — | — |
| scim | — | — | — | — | — |
Example PAT scope for an on-call engineer agent — explicit resource allowlist + intersection with the linked user's roles.
Bring your own LLM. We don't run models on your data.
We do not analyze your incidents with an LLM on our servers. You pick the model, the agent framework, and where it runs. All Quiet is the control plane: scoped credentials, a public REST API, Terraform, and an audit log. Data stays in the EU or US region you chose. Inference happens on your side.
Built for developers
Two Philosophies of AI Incident Management
Most vendors add a chatbot that reads your incidents in their cloud. We made the platform API-complete so your agents can run it, with keys you control.
| Approach | Chatbot-on-top AI |
Agent-operable platform
|
|---|---|---|
| Where the LLM runs | Vendor's cloud — your incident data is sent to their model | Your infrastructure — bring your own LLM or agent runtime |
| Who owns the model | Vendor chooses and updates the model | You choose — OpenAI, Anthropic, local, or any agent framework |
| Permission granularity | Often coarse — admin API keys or full product access | Per-resource scopes (get/list/create/update/delete), team & org allowlists, PAT intersection with human roles |
| Auditability | Opaque — hard to trace what the AI did vs. what a human did | Creates, updates, and deletes of auditable resources land in the audit log, attributed to the key |
| Data residency | Incident content may leave your region for inference | EU or US hosting; no LLM inference on our servers — your data stays where you put it |
| Terraform / IaC | Usually separate from AI features | Native provider — provision keys, teams, and integrations as code |
Two valid philosophies — we built for teams that want agents under their control, not our control.
Built for IT security reviews
Agents need a platform you can put in front of a security review.
ISO 27001 certified
Independently certified by Tempo Audits, a UKAS-accredited body. The same controls cover the public API your agents call.
Least privilege, by design
Per-resource scopes, team and org allowlists, expiry, and IP filters. A personal access token is capped by the user's live roles. Out-of-scope calls return 403.
EU or US residency
Pick the region. Incident data stays there. Inference runs on your side, not on our servers. Creates, updates, and deletes show up in the audit log.
Give every engineer a scoped token and let their agents work against All Quiet. Start a 14-day trial or read the API docs.
Supporting the world's best tech teams
From emerging startups to established enterprises
Frequently Asked Questions (FAQ)
Published: Wednesday, 19 August 2026
Last updated: Wednesday, 19 August 2026
What is AI incident management?
AI incident management is using AI agents or LLM-powered automation to detect, triage, respond to, and learn from incidents — typically by operating your incident platform through APIs rather than a click UI. All Quiet's approach is agent-operable: you bring your own LLM, and All Quiet provides scoped API keys, a complete public REST API, and audit logging so agents can work productively under least privilege.
How is agentic incident management different from classic incident response?
Agentic incident management means autonomous or semi-autonomous agents execute multi-step workflows — search incidents, check on-call, create overrides, configure mappings — by calling APIs on your behalf. Classic incident response is humans driving the same steps through a UI. The platform capabilities overlap; the control surface shifts from clicks to scoped credentials plus an agent runtime you own.
Can AI agents run rogue on All Quiet? How do you contain them?
Agents can only do what their API key allows — and for personal access tokens, only what the intersection of key scopes and the linked human's roles permits. You assign per-resource permissions (get, list, create, update, delete), optional team and organization allowlists, expiry dates, and IP filters. Out-of-scope calls return 403 Forbidden. Creates, updates, and deletes of auditable resources land in the audit log, attributed to the key. Reads and failed auth checks do not.
Does All Quiet run LLMs over my incident data?
No. All Quiet does not analyze your incidents with our own LLMs. Our AI incident management story is bring your own LLM: you run the model and agent framework; All Quiet is the API control plane. Your data stays in your chosen region (EU or US hosting); inference happens on infrastructure you control.
What can an agent access via the All Quiet public API?
The public API covers incidents, teams, team escalations (schedules and rotations), on-call and on-call overrides, inbound and outbound integrations, integration mappings and payloads, status pages, routing rules, users, organizations, audit logs, and more. Each resource supports granular scope verbs. See the Public API documentation for the full surface.
Personal access token vs. organization API key — which should agents use?
Use a personal access token (PAT) when an agent acts on behalf of a specific engineer — the token inherits that user's team memberships and is further restricted by declared scopes. Use an organization API key for pipeline automation (CI/CD, Terraform, org-wide integrations) where no human user context applies. PATs cannot grant SCIM provisioning or user create/delete; org keys can include SCIM for identity sync.
Updated July 16, 2026