Automation Execution
Relevant source files
The following files were used as context for generating this wiki page:
Automation Execution provides a safe, audited, and human-approved method for making changes to network infrastructure. It ensures that no AI-driven agent can directly modify device configurations, DNS records, or firewall policies without explicit human intervention.
For a network engineer, this feature acts as a "Change Control Gatekeeper." When you or the AI assistant identifies a needed change—such as adding a DNS record or fixing a firewall policy—the platform drafts a formal request. A second human must review and approve this draft before the "Automation Agent" (the platform's specialist executor) is permitted to apply the change to the production environment.
Sources: CLAUDE.md:14-22, backend/app/agents/ddi/agent.py:15-25, backend/app/agents/security/agent.py:15-25
Platform Overview
The AI Network Operations Platform is a self-hosted assistant designed for enterprise network teams to manage multi-vendor environments securely. It solves the problem of manual, error-prone configuration changes by providing an AI-driven workflow where every decision is explained and every action is audited.
Supported Vendors and Protocols
The platform connects to your network using standardized connectors (vendor plugins) for a wide range of hardware and cloud providers:
- Routing & Switching: Cisco (IOS, IOS-XE, NX-OS), Juniper (JunOS), Arista (EOS).
- Security & Firewalls: Palo Alto (PAN-OS), Fortinet (FortiOS).
- Application Delivery: F5 (BIG-IP).
- DDI (DNS, DHCP, IPAM): BlueCat, Infoblox.
- Cloud & Virtualization: AWS, Azure, VMware.
Design Philosophy
- Local-First & Self-Hosted: The platform runs entirely within your own data center or private cloud, ensuring sensitive network data never leaves your control.
- Human-in-the-Loop: No agent applies a change directly; every request routes through a Change Request spine for human approval.
- Auditability: Every AI reasoning step and tool execution is logged for transparency.
Sources: CLAUDE.md:1-40, README.md:1-15, backend/app/agents/ddi/agent.py:53-65
Specialist Agents (Team Members)
The platform uses specialized agents, which you can think of as expert team members. The Master Architect (the supervisor) routes your questions to the correct specialist:
- Discovery Agent: Enumerates inventory and scans the network.
- Troubleshooting Agent: Diagnoses live routing, BGP, OSPF, and ACL faults.
- DDI Agent: Manages DNS/DHCP records and resolves address conflicts.
- Security Agent: Audits firewall policies for shadowed or redundant rules.
- Automation Agent: The sole executor of already-approved Change Requests.
Sources: CLAUDE.md:42-52, backend/app/llm/prompts/init.py:180-260
Architecture
The platform consists of seven core components that work together to provide a secure operations environment.
- frontend: The operations console where engineers chat with the AI, view the topology map, and approve changes.
- api: The central brain that handles communication between the frontend, the database, and the AI agents.
- worker: The background engine that runs long jobs like discovery scans and configuration backups without blocking your chat session.
- postgres: The system of record that stores all device data, change logs, and audit trails.
- neo4j: A living topology map that tracks how every device, interface, and subnet connects to everything else.
- redis: A fast message broker that coordinates tasks for the background engine.
- ollama: An optional local inference engine that allows you to run AI models entirely on-premises.
Sources: README.md:17-30, deploy/docker/README.md:9-17
Deployment Options
- Docker Compose: Ideal for lab environments or small teams. It runs the entire platform on a single server using a simple configuration file.
- Kubernetes (Helm): Designed for production enterprise use. It provides a multi-node, highly available deployment with advanced security hardening, such as network segmentation and automated backups.
Sources: deploy/docker/README.md:1-8, deploy/kubernetes/netops/README.md:1-15
Change Approval Workflow
The Automation Execution system follows a strict lifecycle for every change. This ensures that the platform never acts as an "autonomous loose cannon."
- Draft: A specialist agent (like the DDI or Security Agent) identifies a needed change and creates a Change Request (CR) draft.
- Pending Approval: The CR is visible in the frontend console, awaiting a human engineer's review.
- Approved: An authorized engineer reviews the proposed commands and approves the request.
- Executing: The Automation Agent takes the approved CR and triggers the execution.
- Pre-Change Backup: Before any command is sent to a device, the platform automatically takes a configuration backup.
- Completed or Rolled Back: If the execution succeeds, it is marked as completed. If a failure occurs, the platform supports rolling back to the previous state.
Sources: README.md:6-15, backend/app/agents/ddi/agent.py:15-25, backend/app/agents/security/agent.py:15-25, backend/app/llm/prompts/init.py:245-255
Visual Diagrams
System Overview
The following diagram shows how users interact with the platform and how the platform connects to your infrastructure and AI providers.
Explanation: The engineer accesses the platform via a frontend console, which talks to the central API. The API coordinates with AI models for reasoning and standardized plugins to talk to various network vendors.
Sources: CLAUDE.md:24-40, README.md:17-30, deploy/kubernetes/netops/README.md:17-30
Agent Routing and Specialist Specialist Workflow
This diagram illustrates how the Master Architect routes a user's request to a specialist agent and the resulting action path.
Explanation: Every request is analyzed by the Master Architect. Read-only tasks (like checking a route) happen immediately, while write tasks (like adding an IP) are trapped by an approval gate to create a draft Change Request.
Sources: backend/app/llm/prompts/init.py:180-260, backend/app/agents/ddi/agent.py:15-30
Change Approval Lifecycle
The full lifecycle of a network change from the initial request to final execution.
Explanation: No change is applied until a human reviews and approves the draft. The process includes safety steps like automatic backups and rollback capabilities.
Sources: README.md:6-15, backend/app/agents/ddi/agent.py:65-75
Topology Data Model
This diagram shows "what the platform knows about your network" by relating different network objects within the topology map.
Explanation: The platform tracks relationships between physical hardware (Devices/Interfaces) and logical constructs (Subnets/VLANs/DNS) to build a complete map of application dependencies.
Sources: CLAUDE.md:58-65, backend/app/agents/documentation/agent.py:10-20
Deployment Options: Single Server vs. Production
Comparison of the two primary ways to deploy the platform.
Explanation: Docker Compose is for simplicity on a single host (lab/dev), while Kubernetes/Helm is for enterprise production with multiple nodes and high security.
Sources: deploy/docker/README.md:1-8, deploy/kubernetes/netops/README.md:1-15
Conclusion
Automation Execution ensures that AI efficiency never comes at the cost of network stability. By strictly separating the Drafting of changes (done by DDI or Security Agents) from the Execution of changes (done by the Automation Agent after human approval), the platform provides a robust safety net for modern network operations.
Sources: backend/app/llm/prompts/init.py:245-260, backend/app/agents/ddi/agent.py:15-25