DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Concepts and glossary

The terms NopsAI uses, and what each one does and does not control.

ReferenceNew userAutomation authorOperator

Key points

  • Pipeline — a named YAML workflow made of steps. The unit you run, schedule, and trigger.
  • Step — one node in the pipeline graph. Exactly one execution mode: include, tasks, goal, script, or approval.
  • Task — a unit inside a multi-task step. Defines exactly one of goal or script.
  • Run — one execution of a pipeline, with its own logs, outputs, approvals, and audit trail.
  • Scope — the namespace that resolves runtime variables and secrets for a run.
  • Team path — the ownership boundary (platform/payments) used for access, notifications, and GitOps authority.
  • Runner — a Docker or Kubernetes worker that accepts assigned runs from the dispatcher.
  • Agent — the per-run process a runner starts; it drives step containers or pods and reports status back.
  • Agent role — persona and prompt instructions. Controls how the AI behaves, not what it may access.
  • Model — provider, model, endpoint, credential reference, and generation settings.
  • MCP Profile — the allowlist of external MCP servers and tools available to LLM goal work.
  • Knowledge Context — documents injected into prompts. guardrail and policy kinds also block execution.
  • AAA — the authorization service that decides whether the original caller may use each selected resource.
  • GitOps — configuration repositories that own resource definitions; UI and API edits create database overrides.

How it works

The AI control layers are deliberately separate. An Agent role cannot grant provider access, an Model cannot change the persona, an MCP Profile cannot widen AAA permissions, and Knowledge Context cannot by itself authorize a runtime resource.

Scope and team path are different axes. Scope answers "which variables and secrets resolve for this run"; team path answers "who owns this resource and who gets notified".

Implementation evidence

  • doc/decision-architecture.md

    Why the separation between control layers exists.