Forensic · investigation surface

When something goes wrong, find out exactly why.

Cases open themselves. Evidence chains build themselves. Resolution plans cite the rows that proved them right. Owners get notified before customers do. APO investigates so your operators don't have to play detective at 2am.

CASES TODAY · 8RESOLVED · 3MED TIME-TO-RESOLVE · 14m
scope · investigation surfacepowered by ESAP AI
Investigation case browser · 8 open

Pick a case. Read the receipts.

click any card →
INV-00237severity · midPayment · PAY-AR-2104

Duplicate settlement on order #41992

Two settlement events fired within 4 seconds on the same payment. Idempotency check missing on the auth-success webhook.

CONFIDENCE
94%
CLASSIFIED · System Failure
Responsible · attribution
Khalid R.
role · ops · view in observatory →
Evidence chain4 events
🛒
Checkout
16:02:11
Auth pass
16:02:13
Settle ×2
16:02:14
Duplicate
16:02:14
Resolution plan
  • Auto-reverse second settlement
  • Patch idempotency key on settle endpoint
  • Add regression test for double-fire
Status
open
investigating
resolved
Classifications · 6 / 6

Six classifications, one investigation.

Every case gets sorted into one of six root-cause buckets. Operators learn the patterns; auditors get the consistency.

Process Gap

Approval flow has no fallback reviewer.

Human Error

Override flag flipped without note.

System Failure

Connector retry loop without backoff.

Data Inconsistency

Inventory count drifted from receive log.

Policy Violation

Refund threshold bypassed via manual scope.

External Cause

Hardware fault in field equipment.

Stop reconstructing what happened. Read the reconstruction.

APO opens cases on its own, builds the evidence chain, and proposes the resolution. Operators sign off. The audit trail writes itself.