Unified L1 Copilot Platform

Context

Tech Mahindra runs cloud operations for Indonesia's largest telco. The estate spans 20+ AWS accounts and 10+ Kubernetes clusters carrying production workloads that serve millions of subscribers, under SLAs that do not bend.

That estate ran on a small, rotating bench of L1 engineers covering it 24/7. Coverage never stopped, but depth did: whoever was on shift had to carry the same breadth of knowledge as the whole team, at 3 AM as much as at 3 PM, with no room to specialize and no backup a few minutes away.

I was brought in to direct AIOps R&D, leading a team of four engineers with a mandate to streamline day-to-day operations through AI and automation, so SLA attainment stops depending on how many experienced people happen to be awake.

Challenge

Enterprise IT operations rarely fail from a single cause. The team was stretched across multiple concurrent workloads, running with limited headcount, and pushed to process a high volume of daily change requests, all while gaps in observability oversight made problems harder to catch early. Three bottlenecks compounded on top of each other.

• Detection lag.
  Infrastructure anomalies surfaced through downstream symptoms, a service alarm, a customer report, rather than at the source, giving a small, contained fault time to cascade into a customer-visible outage before anyone even knew to look. Mean time to detect sat around 20 minutes.
• Triage lag.
  Once detected, first-level root cause analysis meant an engineer correlating monitoring, CMDB, and documentation by hand, so every incident's resolution depended on whoever happened to be on shift knowing where to look, with no consistent floor on how fast that correlation actually happened. Mean time to resolve sat around 30 minutes.
• Change-review lag.
  Every Method-of-Procedure was reviewed manually before deployment, ~60 minutes per cycle, capping the team at 1–2 change requests per day and building a backlog that pressured reviewers to rush, exactly the condition under which a bad deployment slips through.

Action

To tackle these challenges, I architected a centralized AIOps engine that brings IT infrastructure monitoring, ITSM, CMDB, and internal documentation together into a single correlation layer, instead of leaving them as disconnected tools each engineer has to check separately. Telemetry and tickets feed one AI model that cross-references a knowledge base and memory store for context, then executes through an MCP-connected automation layer.

Three pillars hold that engine up:

1. RAG knowledge base

   Runbooks, documentation, CMDB and historical incidents made retrievable, so every agent reasons over the same operational ground truth instead of a hardcoded subset.

2. MCP servers

   Tool access exposed through Model Context Protocol, so capabilities are declared once and reused across workflows rather than re-integrated per use case.

3. Human-in-the-loop governance

   Every action the system proposes is still routed through an approve/reject step before reaching production. The system closes blind spots in observability without giving up institutional control over what actually runs.

That's the "unified" part: this engine doesn't just handle detection and RCA, it consolidates the automation workflows that used to live as separate tools into one platform, triaging alerts, recommending a first-pass fix, generating reports, and reviewing Method-of-Procedure steps before deployment, catching invalid steps before they reach a review meeting, or worse, execution. The result is a scalable foundation rather than a set of point solutions: new CloudOps AI capability plugs into the same retrieval, tooling, and governance instead of standing up its own.

Tech Stack

Microsoft Azure AI Foundry powers the frontend chatbot interface, integrated with Microsoft Teams. Amazon API Gateway is the backend entry point, routing each request to the right automation or workflow. MCP itself runs on AWS ECS, with Amazon OpenSearch Service behind the RAG layer, Amazon DynamoDB holding short-term memory and Amazon S3 holding long-term memory. Amazon Bedrock serves the underlying AI model, and AWS Lambda and AWS Systems Manager Automation execute the automations it decides on. Datadog is the observability layer everything gets correlated against, and Dify handles orchestration whenever a complex agentic process needs coordinating.

Results

Detection four times faster, resolution three times faster, change throughput roughly doubled, and close to a full day of engineering time reclaimed every week through automated report generation. That's what it actually took to relieve the fatigue that small, rotating bench of L1 engineers was carrying every shift.