What it can and can't do
Can (read-only)
- List the client's devices and their status
- Read the latest health snapshot: CPU, memory, disks, network, services
- Read recent event log entries, with filters
- Read installed software and recent software changes
- Read open and recent alerts
- Read the ticket and its conversation
- List approved scripts in your library
- Record proposed actions for review
Can't
- Run scripts or commands on a device
- Change settings, users or software
- See other clients' data
- Read file contents
- Propose a script that isn't approved in your library
Start an investigation
- Open the client workspace in the CitadelGate portal.
- From a ticket, or with a plain-language description, start an investigation. Describe the issue or the outcome you want, for example "Accounts can't print since this morning" or "Check whether every laptop has disk encryption on".
- The job is queued and runs in the background, usually within a minute or two.
Until the portal panel ships, use the API.
Read the report
Each report has five sections: Summary, Findings (each with evidence), Likely cause (with a confidence level), Recommended actions and Gaps (what it couldn't check). If the investigation came from a ticket, the report is added to the ticket as an internal note that client users can't see.
Proposed actions
A proposal names an approved library script, the target device, parameters, the rationale, the expected outcome and the rollback. Each shows its risk level, and whether it would be eligible for automatic running in a future release (only ReadOnly or Low risk scripts that have been approved, never by default). In this release proposals are recommendations only: a technician decides what to do.
Good practice
- Be specific: name the user, device or symptom when you know it.
- Check the Gaps section before acting; stale or missing telemetry is called out there.
- Add a library script for any fix the AI recommends manually, so next time it can propose it.