How Akritas Works

For alerts, Akritas first normalizes provider data, durably deduplicates and correlates it, and creates an asynchronous investigation job. The investigation then uses the same bounded retrieval, planning, skill, and read-only tool loop.

The host remains authoritative. Retrieval does not prove a diagnostic step ran. A successful diagnostic ToolResult is execution evidence; model prose is not.