{"slug": "observe-vs-investigate-always-on-agent-vs-on-demand-cli", "title": "Observe vs investigate: always-on agent vs on-demand CLI", "summary": "Kprompt introduced an always-on Observe agent that continuously watches a Kubernetes namespace and triggers gated notifications on incidents, complementing its on-demand CLI investigate command. Both modes share the same Investigation Graph DNA, but differ in trigger, scope, and mutation behavior, with the Observe agent never mutating by default and requiring explicit approval for any changes.", "body_md": "Same Investigation Graph DNA — different trigger. Laptop investigate is reactive; the optional Observe agent is continuous watch → Incident → gated notify.\n\n*Originally published at https://kprompt.ai/blog/observe-vs-investigate.*\n\nOperators ask the same question two ways: “why is checkout broken right now?” and “tell me when payments starts misbehaving without me watching.” kprompt answers both — but with different surfaces. Confusing them is how you end up expecting a laptop REPL to page Slack, or an in-cluster watcher to silently apply fixes.\n\n| Surface | Trigger | Scope | Mutate? | Artifact |\n|---|---|---|---|---|\nCLI `investigate` / `why` / `timeline`\n|\nYou type a prompt | kubeconfig context(s) | Only after PlanResult approval | Investigation → optional PlanResult |\n| Observe agent | Always-on watch | One namespace (Role) | Never by default | Incident / AgentAlert |\n| Autopilot (opt-in) | Open Incident + allowlist | Same ns agent | Propose-only; apply gated | PlanResult (`Applied` false) |\n\nAlways-on intelligence is the same gated [Investigation Graph](https://github.com/kprompt/kprompt/blob/main/docs/investigation-graph.md) as CLI investigate — signal hops → findings → optional PlanResult → approve → apply → verify. It is not a free-form multi-agent fleet. Observe / Namespace Agent runs the continuous edge of that graph; [investigate](https://github.com/kprompt/kprompt/blob/main/docs/investigate.md) is the on-demand hop you steer from a laptop. Modes table: [namespace-agent](https://github.com/kprompt/kprompt/blob/main/docs/namespace-agent.md).\n\n```\n# On-demand RCA (reactive)\nkprompt \"investigate checkout\" -n payments\nkprompt \"why is api crashing\" -n payments\nkprompt \"timeline for checkout\" -n payments\n# Always-on Observe (continuous)\nkprompt agent run -n payments \\\n  --analyze --fetch-logs --health --heuristic\n\n# in-cluster: Helm charts/kprompt-agent (namespace Role)\ngit clone https://github.com/kprompt/kprompt-examples.git\ncd kprompt-examples\nmake walkthrough\n\n# afterward, on-demand:\nkprompt \"investigate checkout\" -n payments\n```\n\nHeuristic Observe needs no LLM key. Investigate with a provider when you want richer narration — still read-first; mutations stay behind approval. Pair with [alert fatigue gates](https://kprompt.ai/blog/observe-agent-alert-fatigue) and the [kind demo](https://kprompt.ai/blog/observe-agent-kind-demo). Experimental — prefer kind / non-prod first.\n\n**Try:** [kprompt.ai](https://kprompt.ai) · [GitHub](https://github.com/kprompt/kprompt) · `brew install kprompt/tap/kprompt`\n\nMuhtalip", "url": "https://wpnews.pro/news/observe-vs-investigate-always-on-agent-vs-on-demand-cli", "canonical_source": "https://dev.to/muhtalipdede/observe-vs-investigate-always-on-agent-vs-on-demand-cli-2ccj", "published_at": "2026-08-16 11:49:12+00:00", "updated_at": "2026-08-16 12:13:15.910056+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "ai-products"], "entities": ["kprompt", "Kubernetes", "Helm", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/observe-vs-investigate-always-on-agent-vs-on-demand-cli", "markdown": "https://wpnews.pro/news/observe-vs-investigate-always-on-agent-vs-on-demand-cli.md", "text": "https://wpnews.pro/news/observe-vs-investigate-always-on-agent-vs-on-demand-cli.txt", "jsonld": "https://wpnews.pro/news/observe-vs-investigate-always-on-agent-vs-on-demand-cli.jsonld"}}