# Platform operations · Neural Inverse Govern > Self-healing with approval and a kill switch, adaptive admission control, health probes and metrics, a rollout gate, and the operator tools for status, SLAs, runbooks, disaster recovery drills, feature flags and alerts. Source: https://neuralinverse.com/govern/operations/ --- ![](/photos/hangar.jpg) [Neural Inverse Govern / Platform operations](https://neuralinverse.com/govern/) # A control plane that keeps itself healthy and tells you when it cannot. Self-healing with approval and a kill switch, adaptive admission control, health probes and metrics, a rollout gate, and the operator tools for status, SLAs, runbooks, disaster recovery drills, feature flags and alerts. Watches Process, database, disks, certificates, jobs Acts Playbooks with verification and approval Sheds By priority, with per-organisation bulkheads Alerts Log and HMAC-signed webhook Runs Air-gapped, from memory during database outages Overview Govern looks after itself. Each process watches its own runtime and the dependencies it needs, PostgreSQL first, learns baselines, sheds load under pressure, runs remediation playbooks within strict limits, checks that a repair worked and escalates to operators when it did not. Detection and alerting keep running from memory while the database is down. Around it are the tools an operator uses every day: probes and metrics, a rollout gate, a status page, SLA reports, runbooks, disaster recovery drills and feature flags. [What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started) What it does ## What platform operations covers. Self-healing and the operator tools that work today. - **What it watches:** HTTP errors and latency, Go runtime memory and garbage collection, file descriptors, the database pool, PostgreSQL connections, long and idle transactions, lock waits and replication lag, disks, certificates and every background job. - **Anomaly detection:** Baselines learnt per hour of the week, SLO burn-rate rules on availability, loopback canaries of the server's own sign-in endpoints, and findings that most nodes share or a new release regresses. - **Remediation playbooks:** Capture diagnostics, release memory, shed batch traffic, recycle database connections, restart a stalled job, prune diagnostics or drain a node, each followed by a check that it worked. - **Safe by construction:** Actions run under a mode, a cluster-wide kill switch, cooldowns, an hourly budget per node and prechecks. Disruptive actions such as draining a node wait for an operator's approval. - **Admission control:** An adaptive concurrency limit with request classes: probes are never shed, sign-in and token endpoints have headroom, and exports and bulk jobs give way first. - **Tenant bulkheads:** Under load one organisation may hold at most a share of capacity. Refused requests get 503 or 429 with a retry time. - **Supervised jobs:** Every background job reports heartbeats, runs, durations and failures; crash loops and stalls raise findings and a stalled job is restarted. - **Across every plane:** The same self-healing runs in the data plane, the compliance plane, the provisioner and the sandbox daemons. - **Drills and the rollout gate:** Rehearse detection and alerting with drills, and let deploy tooling hold or roll back a release that is not ready or regresses against the previous one. - **Probes and metrics:** Liveness and readiness probes, a drain-aware readiness probe, Prometheus metrics for scrapers, and a break-glass status that works while the database is down. - **Signed alerts:** Alerts go to the log and, if you set one, to your webhook, signed with HMAC-SHA256 and a timestamp and retried up to five times. - **Status page and SLAs:** Status components and incidents with email subscriptions confirmed by double opt-in, and monthly SLA reports with service credits per tier. - **Runbooks and DR tests:** Operational runbooks, a platform incident log and scheduled disaster recovery drills whose pass or fail Govern decides. Every write needs a reason and is audited. - **Database and cluster:** Live connection pool statistics, slow queries, a connection pooler configuration generator, the nodes in the cluster, and a version compatibility matrix with upgrade history. - **Integration and email health:** Probes of your integrations, webhooks, database and certificate expiry, and the health of outbound email delivery. - **Feature flags:** Flags per organisation with targeting rules, percentage rollout, a kill switch, evaluation statistics and a change log. How it works ## How a node under pressure is handled. 1. Detect A rule fires: memory at 85% of the limit for three ticks. 2. Relieve Diagnostics are captured, memory released and batch traffic shed. 3. Verify Selfguard checks whether the pressure fell. 4. Approve If not, draining the node is proposed and waits for an operator. 5. Drain Readiness turns false for three minutes so load balancers route around it. 6. Record Every finding and action is in the audit log with the change. Who uses it ## Built for every role that answers for AI. - **Site reliability engineers:** Triage findings, approve or reject disruptive actions and run drills at handover. - **Release managers:** Gate releases on the rollout gate and its soak time. - **Platform operators:** Run the status page, SLA reports, runbooks and disaster recovery drills. - **Product teams:** Roll features out gradually with flags and turn them off with the kill switch. Enforced and recorded ## Bounded, approved and on record. Self-healing can only do what its limits allow, and everything it does is audited. Enforced - **Limits on actions:** A kill switch that reaches every node within one tick, cooldowns, an hourly budget and post-action checks. - **Approval:** Draining a node and ending idle database transactions need an operator's approval within a time window. A node is never drained when it is the only one. - **Operator routes:** Self-healing and platform operator routes are for super admins, and every change needs a reason. - **Fail fast on configuration:** An invalid setting stops the start with a message naming it, rather than running half-configured. Recorded - **Findings and actions:** Every automatic or operator action and every finding transition, in the same transaction as the change. - **During outages:** History is buffered in memory while the database is down and written once it returns; anything dropped is counted. - **Operator records:** Runbook, incident and DR test changes with the operator and the reason. Where it runs ## Inside every Govern process. [Deployment options](https://neuralinverse.com/deployment/) - **Self-hosted:** Runs in your installation with no external calls; alerts go to your log and your webhook. - **Air-gapped:** Detection, healing and alerting need nothing outside your network. - **Hosted by us:** We operate it for you; customers see platform health through the status page. Get started ## Set it up with the documentation. - [Monitoring and self-healing](https://neuralinverse.com/docs/deploy/monitoring/) - [Troubleshooting](https://neuralinverse.com/docs/deploy/troubleshooting/) - [Upgrades and migrations](https://neuralinverse.com/docs/deploy/upgrades/) - [Backup and restore](https://neuralinverse.com/docs/deploy/backup-restore/) What's next ## Being built now. These are in development and not part of the product today. - **Organisation webhooks:** Outbound webhooks for organisation events with signed delivery, retries, a dead-letter view and test sends. - **Notification inbox:** An in-app inbox for each person with email and webhook channels and preferences. - **Event-triggered workflows:** Workflows that run on platform events, not only when started by hand. - **Richer flag targeting:** Feature flag targeting by location, custom expressions and cohorts. - **Self-healing console:** Console pages for findings, actions and drills beyond the operator area's self-healing page. Related [Observe → Metrics, log groups, alarms and the built-in telemetry pipeline, with search and signed export.](https://neuralinverse.com/govern/observe/)[Audit and evidence → A hash-chained audit log you can verify offline, and evidence toward your frameworks.](https://neuralinverse.com/govern/audit/)[Organisations and accounts → Organisations of accounts, organisational units, guardrail policies, consolidated billing and service quotas.](https://neuralinverse.com/govern/organizations/) ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)