The difference between an Agent that only advises and one that goes and checks is whether it has somewhere to work.
Every AI SRE investigation runs in a real execution environment: running commands, calling APIs, processing data, producing reports. That environment comes in two forms, and you pick based on where your systems live.
Cloud Sandbox: works out of the box
The default. Flashduty hosts it, creates it on demand when a session starts, and runs it in isolation. It ships with the command-line tools an investigation usually needs, so the Agent can read and write files, run scripts, and call public APIs directly. You can also give the cloud environment an egress allowlist, environment variables, and an init script, so every new Sandbox comes up matching your team's conventions.
BYOC Runner: put execution inside your network
When the systems under investigation sit on an internal network, a public environment cannot reach them. Deploy a Runner on your own machine instead, and the Agent executes from inside your network.
The Runner dials out to establish the connection, so you never open an inbound port for it and never expose internal addresses to the public internet. It bundles the tooling an investigation needs, including rg, jq, gh, and the Node and Python runtimes, so there is nothing to install one by one afterward. It updates itself on every platform as server-side capabilities move forward, with no manual upgrade step.
You still draw the execution boundary
In either environment, what the Agent may write, which credentials it can use, and what network it can reach all follow your configuration. Production changes, restarts, rollbacks, and outbound notifications always wait for a human to confirm.
Getting started
Go to Flashduty console → AI SRE → Environments, where the tabs at the top switch between Self-hosted and Cloud.
See the product documentation for details.
This is available to On-call Professional accounts and above, alongside the AI SRE public beta.