Alerts are abundant; causes are not
Alerts arrive per tool with no correlation, so root-cause judgment still depends on an experienced operator.
AUTONOMOUS OPERATIONS PLATFORM
Predict, act under approval, prove every decision.
An AI control plane that sits between the observability stack and the execution tools you already run. It adds prediction, judgment, action and evidence on top of your stack, with no additional collector.
- 12
- AI/ML models
- 77+
- API endpoints
- 7
- Microservices
- 4
- Logical layers
01 / THE PROBLEM
Failures arise from compound causes
In an environment where messaging, databases, API gateways, containers and applications are entangled, failures come from compound causes. Tooling multiplied, while judgment, action and accountability stayed with people.
Action remains manual
Detection is automated; action is not. Night and holiday delays accumulate directly into MTTR.
Automated action cannot be enabled
Turning on automated action introduces misfires, duplicate execution and runaway loops. Without policy and rollback, it cannot be switched on.
No evidence remains
Financial and public-sector audits do not ask whether you recovered. They ask for the rationale, the approval record and immutable evidence of the outcome.
Orbiton.AI unifies these four into a single control loop.
02 / CATEGORY
From monitoring to autonomous operations
The global market has already moved past observability toward AI-driven autonomous operations. Orbiton.AI sits at the final stage.
- 01Monitoring“What happened?”
Metric collection and threshold alerts
- 02Observability“Why did it happen?”
Unified metric, log and trace analysis
- 03AIOps“What should be done?”
Correlation, anomaly detection, recommended action
- 04Autonomous Ops“Did it handle itself?”
Policy-driven execution, verification, rollback and evidence
Orbiton.AI
The global AIOps market is led by Dynatrace (causal AI root-cause analysis), Datadog (unified observability with ML anomaly detection), BigPanda and Moogsoft (event correlation and noise reduction), ServiceNow (ITSM workflow) and IBM Instana (hybrid cloud operations). Their shared limit is that execution, verification, rollback and regulatory evidence live in separate product lines. Orbiton.AI unifies that span into one engine.
03 / OVERVIEW
Turn operational signals into action
An AI control plane placed between the observability stack and the execution tools already in use.
It predicts
Time-series forecasting and unsupervised anomaly detection surface risk before a threshold is crossed. A rule-based risk score runs alongside the ML models, so the system operates from day one, before training data accumulates.
- Forecasting
- Anomaly detection
- Cause classification
- Risk score
It acts
The policy engine decides what is permitted and what needs approval; the workflow engine carries execution, verification and rollback through a state machine. A failed action is always reverted.
- Policy-as-Code
- HITL approval
- Auto verification
- Auto rollback
It proves
Every rationale and approval from detection to closure is written to immutable storage, and audit reports plus weekly and monthly operations reports are generated automatically.
- Evidence store
- Audit report
- Periodic report
- WORM retention
Kafka · RabbitMQ · Pulsar · Kubernetes · Database · API Gateway · in-house applications — target systems are swapped by driver.
04 / ARCHITECTURE
Four logical layers
Layers couple only through standard interfaces; replacing one leaves the rest running.
04Evidence layerEvidence
- Immutable evidence store (WORM)
- Automated audit reports
- Weekly and monthly reports
- ITSM ticket attachment
03Control layerControl
- Policy engine (OPA/Rego)
- Workflow engine (SOAR)
- Approval, action, verification, rollback
- Duplicate execution guard
02Intelligence layerIntelligence
- Forecasting and anomaly models
- Root-cause classification
- Action recommendation engine
- Model governance (MRM)
01Observability layerObservability
- Full-stack observability
- OpenTelemetry collection
- Metric, log and trace normalization
- Query adapter and system drivers
Multi-tenancy (tenant_id / cluster_id) and data boundaries are enforced in every layer, and service-to-service traffic is fixed to mTLS.
05 / CAPABILITIES
Six core modules
Forecasting and anomaly detection
LSTM · Prophet · TFT · N-BEATSDetect issues faster and improve reliability. Four time-series models with an Isolation Forest and USAD ensemble catch backlog and resource risk before any threshold is reached.
Causal root-cause inference
DoWhy 4-stepAccelerate incident investigation. Four-step causal inference determines whether a metric shift is the actual cause and presents the reasoning.
SOAR workflows
YAML · DAGActions are managed as declarative definitions. A DAG workflow defined in YAML performs branching, retries, cooldowns, verification and rollback.
Policy-based control
OPA RegoPolicy fixes the permitted action space — automatic execution, approval requirement, attempt budget, cooldown and the per-risk action list.
Evidence and reporting
Hash chainBuild the evidence regulators ask for, automatically. Hash-chained audit logs and per-incident snapshots are stored, and post-mortem, RCA and periodic reports are published on schedule.
Operator Agent
SSE streamingQuery state through a streaming conversation and receive causes and candidate actions. Execution must still pass policy evaluation and the approval gate.
The six modules operate as a single closed control loop.
06 / AI ENGINE
Twelve models produce one decision
No single model carries the decision. Forecasting, judgment, inference, learning and quality monitoring are split across models whose outputs combine into one decision.
Forecasting and judgment
| Model | Role | Implementation |
|---|---|---|
| LSTM | Forecasting | PyTorch · PyTorch-Forecasting |
| Prophet | Forecasting | Prophet · holidays-KR |
| Temporal Fusion Transformer | Forecasting | PyTorch-Forecasting (Lim 2021) |
| N-BEATS | Forecasting | PyTorch (Oreshkin 2020) |
| Anomaly ensemble | Anomaly | Scikit-learn Isolation Forest · USAD |
| Causal inference | Cause | EconML · DoWhy (Pearl 4-step) |
Learning and quality
| Model | Role | Implementation |
|---|---|---|
| RL policy | Action selection | Stable-Baselines3 PPO |
| Federated learning | Distributed training | Flower FedAvg |
| DP federated learning | Privacy | Opacus DP-SGD · Flower |
| Continual learning | Knowledge retention | EWC (Kirkpatrick 2017) |
| Drift detection | Quality monitoring | Evidently PSI·KS · River Page-Hinkley |
| Hyperparameter tuning | Search | Optuna TPE sampler |
Every model is deployed as an independent inference endpoint. Training, inference and retraining history is versioned in the model registry, and only approved versions inform real decisions.
07 / INTEGRATION
Integrate with your existing stack without retooling
Orbiton.AI presumes no particular vendor. The boundary where it meets external systems is defined by exactly three plugin types; the rest of the engine is reused unchanged.
Observability data access
Only the metric, trace and log query interface is fixed; the backend stays replaceable.
- Prometheus / OTLP
- Grafana · Tempo · Loki
- Elastic · OpenSearch
- Commercial observability platforms
Target system control
Resource discovery, metric collection and action execution are abstracted into a common model.
- Messaging (Kafka · RabbitMQ · Pulsar)
- Container orchestrators
- Databases and caches
- API gateways and in-house apps
Business process integration
A standard event schema and webhooks keep both directions in sync.
- ITSM and ticketing
- Collaboration and alert channels
- SIEM · SOAR
- Email and intranet portals
Plugin standard — signed manifest, declared permission scopes, sandboxed execution, compatibility matrix, SBOM verification, exponential backoff retry and failure-event retention.
08 / DRIVER MODEL
Real-time discovery with no manual effort
One engine serves every target system. Once a driver implements four methods, the forecasting, anomaly, policy, workflow and evidence engines are reused as-is.
| Common concept | Kafka | RabbitMQ | Pulsar |
|---|---|---|---|
| Backlog | Consumer Lag | Queue Depth | Backlog |
| Destination | Topic | Queue · Exchange | Topic |
| Consumption unit | Consumer Group | Consumer | Subscription |
| Partition unit | Partition | Shard (optional) | Partition |
| Ingress · throughput | Produce · Consume | Publish · Deliver | Publish · Ack |
| Node health | Broker Health | Node Health | Broker Health |
Different names, same concept. The engine only reads the mapped common values.
list_resourcesEnumerate managed resources such as clusters, queues and topicsfetch_metricsNormalize system-specific metrics into the common metric modelexecute_actionExecute scale, restart and configuration-change actionsfetch_schema_samplesSample messages to detect schema drift
Changing the driver leaves the forecast ensemble, anomaly detection, causal inference, policy engine, workflow, approval console and evidence store untouched. Integration is complete once the target metric names and action API are fixed.
09 / GOVERNANCE
Execute at scale with governance and control
A product where AI executes operational change does not clear a procurement review without security and governance in place.
- Layered authentication and separation of duty
- JWT with OAuth2 is combined with MFA (TOTP), and RBAC separates operator, approver and administrator. CSRF double-submit and CSP/HSTS are applied by default.
- Tamper-evident audit trail
- Audit logs are hash-chained so any mid-stream alteration is immediately visible, and a SIEM hook forwards them to external security operations in real time.
- Behavioral anomaly detection (UEBA)
- Account and permission usage patterns are learned to detect insider threat and privilege misuse, promoting risk signals into security events.
- Model risk management
- Models deploy in shadow mode first, and drift detection (PSI, KS, Page-Hinkley) tracks degradation continuously. Optuna retunes; EWC retrains without losing prior knowledge.
- Data sovereignty
- Storage region, inference location, retention period and personal-data handling are declared as per-tenant policy; violations block storage and transmission.
- Air-gapped operation
- An offline registry, signature verification and offline plugin bundles allow installation and updates with no internet connection.
10 / DEPLOYMENT
Deploy in production, air-gapped sites included
If the product itself stops, automation, visibility and audit stop with it. Orbiton.AI ships high availability and disaster recovery as product features.
3AZAvailability zones
Control plane and data plane separated for independent regional execution
15–30 minRecovery time objective
Reduced to 5 minutes with the optional configuration
0–5 minRecovery point objective
Zero with synchronous replication enabled
0Zero-downtime upgrade and rollback
Progressive activation via rolling release and feature flags
- Deployment
- Kubernetes Helm chart · HPA autoscaling · GPU nodeSelector · replicas ≥ 2 for redundancy
- Single-node option
- Docker Compose (16 GB RAM or more) with an nginx reverse proxy — for small or air-gapped sites
- Service structure
- Seven independently deployed microservices with a GitHub Actions build, test and release pipeline
- Hardware
- Inference latency scales with compute. Three tiers: single CPU node, one GPU (recommended), dedicated GPU nodes
- Operational deliverables
- Install, upgrade and rollback runbooks, DR runbook, security guide and an operations checklist
11 / POSITIONING
How Orbiton.AI relates to existing tools
Orbiton.AI does not replace your observability tools. It owns the layer above them that judges, acts and proves.
| Axis | Observability-centric | Event-correlation-centric | Orbiton.AI unified control plane |
|---|---|---|---|
| Dynatrace · Datadog · Instana | BigPanda · Moogsoft · ServiceNow | ||
| Strength | End-to-end observability and root-cause analysis | Alert noise reduction and incident consolidation | Closed loop of predict, judge, act and prove |
| Automated action | Recommendation and trigger | Ticket creation and routing | Execution, verification and rollback after policy evaluation |
| Approval | Handled by a separate tool | Depends on ITSM workflow | In-product approval console with SLA timers |
| Audit evidence | Dashboard queries | Ticket history | Immutable storage with automated audit reports |
| Target coverage | Bound to agent coverage | Bound to connected alert sources | Targets swapped through driver plugins |
| Deployment | SaaS first | SaaS first | On-premises and air-gapped included |
The comparison is a positioning view based on each vendor’s public material, not a feature-by-feature verdict.
12 / USE CASES
Apply one engine across industries
Prevent transaction delay, answer the audit
Backlog on payment and order paths is detected early and scaled under approval, with rationale and approval records submitted directly to audit.
Stabilize the plant data pipeline
Anomalies in data flowing from plant equipment are caught early and recovered automatically within policy, including unstaffed hours.
Unattended operation in air-gapped environments
Install and update with no internet connection, force data storage and inference to stay in-country, and record every action immutably.
Absorb event traffic spikes
Promotion-period surge patterns are learned for preemptive scaling, with resources returned afterward to contain cost.
The engine is identical. Industry differences are absorbed by the policy bundle, workflow bundle and driver combination.
13 / ADOPTION
Adoption path
Start in safe mode and widen automation only as trust accumulates. Automated action is never on from day one.
- PHASE 01
Connect and observe
Attach adapters to the existing observability stack and add the target system driver. Automated action stays off while prediction and anomaly detection are observed.
Output · A detection-quality baseline - PHASE 02
Approval-gated automation
Define policy and open the approval console. Every action passes human approval while the verification and rollback paths are exercised for real.
Output · Action success rate and rollback behavior confirmed - PHASE 03
Selective autonomy
Relax policy so low-risk actions with a proven success rate run without approval. Everything else keeps the approval gate.
Output · Shorter night and holiday response - PHASE 04
Widen the scope
Add drivers and connectors to reach adjacent systems, and retrain models on accumulated operational data.
Output · Adopted as the company-wide operating standard
Each phase is switched by a feature flag, so lowering the flag returns you to the previous phase immediately.
14 / TECH STACK
Technology
Every layer runs on open source and open standards, with no point of lock-in to a cloud or a commercial product.
Backend
- FastAPI 0.115 · Python 3.x
- PostgreSQL + pgvector
- SQLAlchemy · Alembic
- Redis
Frontend
- Vue 3 (Composition API)
- Vite 6.0 · Pinia · Vue Router 4.5
- Bootstrap 5.3
- ApexCharts
AI / ML
- PyTorch · PyTorch-Forecasting
- Prophet · Optuna · Evidently
- Stable-Baselines3 · Flower(FL)
- EconML · DoWhy · River
LLM / RAG
- LangChain 1.x · LangGraph
- pgvector · BM25(rank_bm25)
- BGE 재순위화
- Ollama · OpenAI · Anthropic · Gemini
Operations
- Kubernetes (Helm)
- Docker Compose
- Prometheus · OpenTelemetry
- Loki · Grafana · GitHub Actions
Security
- JWT + OAuth2 · MFA(TOTP)
- RBAC · OPA Rego
- Audit Hash Chain · SIEM Hook
- CSP / HSTS · CSRF Double-Submit
15 / ROADMAP
Roadmap
Each item extends the existing structure rather than changing it. Because the layer interfaces are fixed, capabilities are added without replacing the engine.
GPU-accelerated inference
Move the inference service to a CUDA-based image to cut response latency for time-series and deep-learning models.
Shadow-mode OOD
Automatically classify out-of-domain input and detect topic drift so the model does not fail quietly on what it does not know.
Streaming resilience
Strengthen connection retention and resumption over long responses to stabilize the conversational interface.
Mobile app
Handle approvals and alerts in the field from iOS and Android. The skeleton implementation is ready.
Advanced UEBA
Combine behavioral clustering with anomaly detection to raise real-time behavioral analysis accuracy.
Federated learning at scale
Extend privacy-preserving training across multiple clients to improve model quality without sharing data between customers.
AUTONOMOUS OPERATIONS PLATFORM
From insight to action, from action to evidence.
Run your entire operation with clarity and control. Judgment, action, verification, rollback and evidence — everything after detection — is owned by a single engine.