An AI assistant that answers with evidence, not vibes.
Ask ALDHI is the AI chat built into the GCPS operations platform. It doesn't summarize a dashboard — it investigates: 39 typed tools give it governed access to every data source the platform collects, so it can chase a symptom across SQL health, live faults, Windows events, and Azure alerts and come back with a cited root cause in minutes. All without ever being allowed to write raw SQL or touch a secret.
TypeScript
React 19
SQL Server
One platform, eight sources — and the correlation still lived in someone's head.
The platform already unified the data: report-backed health snapshots, live WMI faults, a rolling 5M+ Windows events, Azure Monitor alerts, materialization logs, application errors. But when something breaks at 6am, root cause still means a human walking across those sources, holding the timeline in their head, and knowing which of them to trust for what. That's expertise — and it's slow, and it doesn't scale past the person who built the system.
The obvious answer — "point a chatbot at the database" — is how you get confident nonsense and a security incident. A model with raw SQL access will happily join live signals to stale reports, leak whatever it can read, and invent what it can't. The design problem wasn't adding AI. It was giving the model real reach without giving it trust.
Real reach, zero trust.
Every capability is a typed tool with a schema, a permission scope, and a cap — never an open connection.
39 tools, grouped by what an operator actually does.
Diagnostic reach across every plane the platform collects — each tool narrow, typed, and capped. 12 load eagerly; 27 lazily.
Alerts & live faults
Active alert triage, HCI health-fault streams, raw alert evidence, and the platform's correlated-context engine — the "what's actually wrong right now" tools.
Windows event forensics
Search and XML detail over the rolling 5M+ forwarded-event window — the needle-finding tools that used to mean hand-written queries.
Raw HCI evidence & reports
Report document search and the raw collector evidence behind any snapshot — so an answer can always be traced to its source.
SQL & pipeline health
SQL Server health, materialization logs, and application errors — the platform diagnoses itself with the same rigor it applies to the fleet.
Azure Resource Health
Resource and OS-config diagnostics from the Azure side, folded into the same investigation as the on-prem signals.
Artifacts & workflows
Diagnostic artifact generation, support-item management, and assignee email preview/send — the guarded write actions that close the loop.
Treat the model like a brilliant operator you don't trust yet.
Same evidence-first discipline as the platform — applied to the AI.
What it can do
- Call 39 typed, permission-aware repository tools
- Read capped rows with explicit source identity
- Correlate live faults, events, alerts & snapshots
- Write its own analysis code — inside a QuickJS sandbox limited to 25 read-only tools
- Generate artifacts, support items, previewed emails & operational scripts
What it can never do
- Write raw SQL — every query is a typed tool
- Pick its own model — no browser-supplied model IDs
- See a secret — credentials never enter tool results
- Read unbounded data — row caps on every tool
- Touch the database outside one guarded, approval-gated write path
The payoff is trust in both directions. Operators trust the answers because every claim carries its source — the same rule the rest of the platform lives by. And the org can trust the assistant with production reach because the boundaries aren't prompt engineering, they're architecture: the tool layer physically can't do the dangerous things. Even its most powerful trick — code mode, where the model writes JavaScript to analyze data across tools — runs inside a QuickJS isolate that only exposes read-only tools, with every write tool explicitly blocked.
It's also engineered like a product, not a demo: conversations persist to SQL with a full audit trail, a regression harness replays live evaluation runs against every change, and telemetry tracks each tool's latency. And it's become a force multiplier beyond triage — the team uses it to generate operational scripts on the fly, which turned the AI from a search box into a teammate.
The investigation and artifact views.
Surface maps describe the publishable interaction model without presenting client data as a screenshot.