04Evidence layerEvidence
- Immutable evidence store (WORM) · automated audit reports · weekly and monthly reports · ITSM ticket attachment
HOW IT WORKS / CLOSED LOOP
Signals into action.
Action into evidence.
Orbiton.AI takes IBM’s autonomic computing reference model (MAPE-K) as its design basis and runs detection through evidence as one state machine. No path skips a step.
01 / CONTROL LOOP
The autonomous control loop
The whole loop is written to the audit log as evidence, and a prevention recommendation is generated automatically once it closes.
- 1Detect
Forecasting and anomaly detection raise the risk and create an incident.
- 2Capture evidence
Metrics, logs and traces around the anomaly window are snapshotted automatically.
- 3Cause and recommendation
Root-cause classification and candidate actions are presented with their risk.
- 4Policy decision
The policy engine decides allow, deny, approval-required and the limits.
- 5Approval (HITL)
An owner approves from the pending queue, with a comment.
- 6Execute
A duplicate-prevention key is set and the action runs through the executor API.
- 7Verify and roll back
Falling short of the success criteria reverts immediately and escalates.
No runaway loops
Repeating the same action on the same incident is blocked by attempt budget and cooldown.
No duplicate execution
An idempotency key and a global deduplication store prevent double action at the source.
Rollback on failure
Failing the verification criteria triggers automatic rollback, then escalation to a person.
02 / FORECAST PIPELINE
How backlog is known in advance
Backlog is what accumulates when ingress outpaces processing. A plain threshold fires once it is already late, and a single model breaks when the pattern shifts. Orbiton.AI decides across five stages.
- STAGE 1
Balance-based instant forecast
Time to threshold is computed directly from the gap between ingress and processing rate. It works on day one, before any training data exists.
- STAGE 2
Time-series ensemble
LSTM handles abrupt change, Prophet the periodic and holiday pattern, TFT and N-BEATS the multivariate long-term trend.
- STAGE 3
Anomaly verdict
A verdict on whether the current state is abnormal. Isolation Forest catches point anomalies, USAD catches sequence anomalies.
- STAGE 4
Causal inference
It separates metrics that merely moved together from the actual cause, using DoWhy’s four steps across throughput drop, rebalancing and infrastructure degradation.
- STAGE 5
Action policy selection
A reinforcement-learning policy trained on past action outcomes proposes candidates; OPA policy and the approver make the final call.
03 / ARCHITECTURE
Separated layers, connected decisions
Collection, inference, policy, execution and evidence are separated so a failure in one area cannot become an unapproved action. Layers couple only through standard interfaces.
03Control layerControl
- Policy engine (OPA/Rego) · workflow engine (SOAR) · approval, action, verification, rollback · duplicate guard
02Intelligence layerIntelligence
- Forecasting and anomaly models · root-cause classification · action recommendation · model governance (MRM)
01Observability layerObservability
- OpenTelemetry collection · metric, log and trace normalization · query adapter · system drivers
Multi-tenancy (tenant_id / cluster_id) and data boundaries are enforced in every layer, and service-to-service traffic is fixed to mTLS.
04 / MODEL LIFECYCLE
It starts without data and reports its own ageing
Training, inference and retraining history is versioned in the model registry, and only approved versions inform real decisions.
- With no data
- Four synthetic scenarios provide the first training pass, while balance-based forecasting and rule-based risk scoring go live immediately.
- As data accumulates
- Periodic retraining runs on operational data with Optuna re-searching hyperparameters, and EWC keeps prior knowledge intact.
- As models age
- PSI, KS and Page-Hinkley watch input distribution and performance, triggering retraining or rollback once the baseline is crossed.
VALIDATION