PulseServe's automation runs as a four-phase pipeline — correlation, triage, root cause analysis, then remediation — and each phase commits its own transaction as it completes, so a human reviewing the incident sees results land in real time instead of waiting for the whole pipeline to finish.
The Remediation Agent takes the incident, the RCA output, and similar past resolutions, and proposes an ordered list of steps. Each step comes with a rationale, an estimated blast radius, whether it is rollback-safe, and whether it requires a formal change ticket. Execution configs can target shell, Ansible, or Terraform — but PulseServe does not run any of them on its own. An operator confirms every step before it executes.
That "confirm before execute" behavior is enforced by configurable HITL gates, not just convention. RCA will not even run until enrichment confidence clears a minimum threshold; remediation will not be proposed unless the RCA confidence clears a higher one; and any incident with a blast radius above a configured number of CIs, or an RCA confidence below a configured floor, is routed to a human review queue regardless of how automated the rest of the pipeline was.
Cascade detection plugs into the same gates: if two or more incidents are firing from the same blast-radius group, PulseServe auto-escalates the group to critical; at three or more, it is treated as a major incident. That escalation changes urgency, not authority — remediation still waits for a person.
The pipeline is built to make the boring 80% of incident response disappear and leave humans exactly where judgment is still required: deciding whether to pull the trigger on production.