← All case studies
Infrastructure AutomationMulti-site web operator

A Self-Diagnosing Operations System That Replaced a Full-Time Role

60+ live sites, watched around the clock by an agent system that finds the real cause of each incident, proposes the fix and carries it out only after a human taps approve. It took over the work of a full-time technical operations hire.

60+
Sites monitored
VPS, cPanel, DNS, WordPress, email
Incident types covered
Full-time ops hire
Role replaced
Every destructive action
Requires human approval
01
The challenge

Before: one person, 60+ sites, and alerts that never stopped.

The operator, a digital publishing business, runs more than 60 live sites spread across many hosting accounts, several providers and a set of individual servers. Keeping all of it healthy meant uptime, bandwidth limits, DNS, email deliverability, WordPress errors and domains quietly approaching expiry.

That was one person's job, and it showed:

  • A single point of failure. When that person was asleep, ill or on holiday, incidents waited.
  • Time lost looking in the wrong place. A site goes down. Is it the server, the DNS or the domain registration? Logging into three panels to find out took longer than the fix.
  • Standing access to everything. One person held the keys to every server, which is a risk in itself.
  • An expensive role that was mostly watching and waiting, punctuated by firefighting.

The brief: rebuild that function as an AI system that never sleeps, never forgets a site and never changes or deletes anything without a human saying yes.

Our approach

What we built: thinking separated from doing.

Diagnose first, read-only

Every specialist works in read-only mode first. It looks, works out what is wrong and proposes a fix. Anything that would change or delete something is posted as an explicit approval request before it can run.

Cheap checks before expensive ones

A domain lookup that needs no credentials tells the system immediately whether a fault sits at the registrar, the DNS or the server. No time or access is spent looking in the wrong place.

A thin, always-on nervous system

Only a lightweight event engine runs permanently. It catches alerts from uptime monitoring and from a dedicated monitoring inbox, enriches each one (which site, which server, which type of fault) and passes it to a coordinator. The intelligence is spun up fresh for each incident, does one job, reports and exits.

One coordinator, scoped specialists

The coordinator holds no site context of its own. It routes each incident to the specialist built for it: one for virtual servers, one for hosting control panel operations, one for DNS and registrar issues, one for the site platform layer, plus a read-only reviewer.

Humans in the chat, guard rails underneath

Oversight lives in a chat channel. The coordinator posts its diagnosis there, asks for approval on any destructive action and logs every step to a thread. Under that sits a hard safety layer: guard hooks that block dangerous commands outright, whatever any agent decides. A stray delete or a restart outside the maintenance window is stopped before it can run.

One inbox for every site's alerts

The multi-account email problem had a simple fix: one domain holds a forwarder per site, all feeding a single monitoring inbox, with a naming scheme that tells the system which site each alert came from.

02
The results

What changed: 24/7 coverage with a full audit trail.

The system took over the work of a full-time infrastructure hire. It watches all 60+ sites continuously, catches incidents as they surface, works out the true cause before acting and carries out fixes only after a human approves them in chat.

Because diagnosis is always read-only and destruction is always gated, the risk is lower than giving one person standing access to everything. Every action is logged. And the cost is a fraction of the role it replaced.

03
Living with it

Day to day now.

At 3am a site starts returning errors. Within minutes the coordinator has identified the site and server, ruled out the domain and DNS, found that the hosting account has hit its bandwidth limit, and posted a diagnosis in the chat channel with a proposed fix. In the morning, someone reads the thread, taps approve, and the fix runs. If the fault was something the system could resolve without changing anything, it is already noted as resolved.

Nobody logs into a control panel to go hunting. The thread is the record.

Built with
Agent SDKn8nSlackUptime monitoring + email alertingcPanel UAPISSHregistrar and DNS APIs
What this looks like for you

The same pattern, in your business.

You may not run 60 sites. But if anything in your business depends on someone noticing a problem and knowing where to look, the same pattern applies: watch continuously, diagnose automatically, act only with approval, log everything.

  • If you run an e-commerce store, it watches checkout, payment and stock sync, and tells you what broke and why before customers start emailing.
  • If you run several locations or franchises, it monitors each site's systems (booking, POS, website) and routes each fault to the right person with the diagnosis attached.
  • If you rely on one IT person or an outside contractor, it takes the watching and first-line diagnosis off their plate, so their time goes on fixes, not hunting.

Want to know which of your systems are worth monitoring this way, and what approvals you would want in place? Start with an AI Consultation.

Show me what I can automate →

Talk through your build →

The service behind it

AI Automation

The same AI Automation discipline keeps your systems standing: watch, diagnose and resolve incidents before a customer notices, with a human approving anything that matters. We wire it into your stack so uptime stops depending on someone being awake.