Sep 6, 2025

Your Feedback Becomes the AI Agent’s Memory: How OrionIQ AI Agents Learn From You

TL;DR:

OrionIQ AI agents, available inside the logz.io platform, now learn from your feedback. Rate any agent run, thumbs up or thumbs down, say why, and the agent re-reads its own run, finds the decision behind the outcome, and writes a lesson. The next run of that agent in your account starts with the lesson in hand. It works for every OrionIQ AI agent, from Alert AI Analysis to scheduled and marketplace agents. Lessons never cross accounts or agents, and you control what the agent keeps. Feedback is how you develop a new engineer. Now it is how you develop your agents.

ORIONIQ AT A GLANCE

OrionIQ introduces a layer of intelligence and automation across the incident lifecycle, helping teams move from detection to resolution with greater speed and consistency.Key capabilities include:

Telemetry Correlation Across Signals
Aggregates and correlates logs, metrics, traces, and recent system changes into a single incident-level view.

Early Root Cause Hypothesis Generation
Surfaces likely causes at the start of an investigation to accelerate initial diagnosis.

Automated Triage and Context Assembly
Collects relevant telemetry and attaches diagnostic context to alerts and tickets before human review.

Alert Prioritization Using System Context
Evaluates alerts against broader system behavior and historical patterns to determine which require action.

Consistent Execution of Operational Workflows
Applies predefined investigation and response steps in a structured and repeatable way.

Shared Incident Context Across Teams
Maintains a consistent set of diagnostic information as incidents move between support, operations, and engineering.

Signal Value Identification for Cost and Clarity
Highlights high-value versus low-value telemetry to support more efficient data usage and cost control.

The same mistake twice is the one that hurts

OrionIQ AI agents already do real work on their own: Alert AI Analysis investigates alerts, scheduled agents review error patterns and service health, marketplace agents cover jobs from cost reviews to security triage. Most of the time they get it right. When they don’t, the reason is rarely random.

Every account has knowledge the telemetry doesn’t carry:

  • “That service is being decommissioned. Ignore it.”
  • “When we say latency we mean p99 on the service dashboard, not p50.”
  • “Errors from the staging namespace are noise during release windows.”

An engineer learns these things once. Until now, an agent had to be told every time. You could rate a run up or down, but it changed nothing about the next run. The agent that ran on Tuesday was exactly as informed as the one that ran on Monday. Agentic observability means agents that get better at your environment the longer they work in it. So we closed the loop.

Give your AI agents the feedback you would give a new hire

Nobody expects a new engineer to know your environment on day one. They get better because the team tells them what they got right and what they missed. The same practice belongs with AI agents in production. Feedback on a run is not a satisfaction survey. It is how the agent learns your environment, your priorities, and the things your telemetry will never say on its own. Make it a team habit: when a run is right, say so and say why. When it is wrong, say what you expected instead. A minute of feedback is the cheapest training your agents will ever get, and unlike a new hire, an agent never forgets.

From feedback to a memorized lesson

Here is what happens when you rate a run and add a comment. It is the same for every agent type.

1. The agent reviews its own run. A background reflection session re-reads the finished run: what the agent looked at, decided, and reported. It does not investigate anything new. Its only evidence is the run you rated and your comment.

2. It looks for one specific decision. Is there a concrete choice in this run that explains the outcome, good or bad, and would a rule about it make the next similar run better? Frustration alone is not evidence, and neither is praise. If the agent cannot point to a real decision in the run, it writes nothing.

3. It writes at most one lesson. A lesson has a situation, a rule that works for this account, and a note on why it exists, tied to the feedback that created it. A thumbs-down teaches the agent what to do differently. A thumbs-up teaches it what to keep doing. If a lesson for the same situation exists, the agent widens it instead of adding a duplicate. If your feedback says a lesson is wrong, it disables it.

4. The next run starts smarter. Every later run of that agent in your account receives its active lessons, marked as learned from feedback, alongside your account instructions and runbooks, which always take precedence.

A lesson looks like this:

Situation: p99 latency spike together with database connection errors.

Rule: Check the deploy and feature-flag feeds first, before attributing the issue to the database or recommending a DBA page.

Why: 2026-08-01 feedback: the root cause was a deploy. Paging the DBA first wasted 20 minutes.

That is the whole record. A person can read it, and it carries its own history, so you can always answer why the agent believes something and which lessons were in play on a given run.

Next incident resolution
Schedule a Demo

AI Agents that are built to learn carefully

An agent that writes a lesson for every complaint is worse than one that writes none, so the mechanism is deliberately conservative.

  • Comments only. A bare thumbs-up or thumbs-down is recorded but does not trigger learning. The agent needs to know why.
  • One lesson at most, often none. Transient errors and one-off details are never captured. Each agent keeps at most 20 active lessons per account.
  • The model judges, code writes. The agent can only propose a lesson. Deterministic code validates it and performs at most one change. Lessons that would override the agent’s instructions or touch credentials are rejected.
  • Advisory, isolated, and yours. Lessons yield to your account instructions and runbooks. They never cross accounts or agents. You can review, disable, or remove any of them.
  • Never in the way. Feedback is acknowledged before any model runs, learning happens in the background, and if the lesson store is unavailable the agent simply runs without lessons.

What this looks like in practice

Week one. A p99 latency alert fires on the checkout service, and the logs are full of database connection errors. Alert AI Analysis concludes the database is saturated and recommends paging the DBA. Twenty minutes later the team finds the real cause: a deploy that changed connection pool settings. The on-call engineer gives the run a thumbs-down: “it was the deploy, not the DB. Paging the DBA wasted 20 minutes.”

Minutes later. The reflection finds the exact decision: the agent saw connection errors and went straight to the database without checking what had changed. It writes the lesson above.

Week two. The same pattern appears. The agent checks the deploy feed first, finds a release twelve minutes before the spike, and reports it as the leading cause with the connection errors as the symptom. The engineer gives it a thumbs-up: “exactly right, the deploy feed was the key.” That confirmation lands in the lesson’s history too.

Continuing the evolution toward agentic observability

Comments are where we started, because a comment is the clearest signal a user can send. Next is learning from outcomes: a control to confirm or reject the root cause on every report, and facts such as when the alert cleared, so a run can teach the agent even when nobody writes a comment. The same loop is also coming to Open 360 AI chat.

Features like this are an early sign that agent-based operations are maturing past the hype phase. The first wave showed that an agent could investigate at all. The questions teams ask now are the ones they ask of anything they run in production: how does it get better, how do I correct it, and how do I audit what it believes. Lessons you can read, trace, and remove are what an answer looks like.