Kindo
Kindo × Deloitte Program
Program Meeting · July 22, 2026

Kindo × Deloitte.

Platform improvements and agent capabilities — observability, performance, and flow control for production SOC automation.

Meeting Goals
1
Align on platform capabilities needed to support production SOC automation at scale — observability, performance, and reliability
2
Establish what's in the current pipeline, what requires new product decisions, and what can be addressed with architecture changes today
Attendees
Charlie Hulcher · Zun Huang · Nathan · Matthew Lew · Tony
Agenda
PRIORITY 1 Agent Observability & Failure Diagnostics
Production SOC agents are live and processing tickets. When an agent fails or stops mid-run, there is no reliable way to determine the root cause — logs roll over within ~20 minutes, and no structured failure data is captured.
This Week — July 15 Escalation
Zun Huang reported multiple agent executions stopping mid-run with no failure reason provided and logs unavailable for debugging. Flagged as high-priority: "affecting our capabilities of building a reliable agentic SOC." The upcoming 2026.07 release includes execution durability improvements, context compaction, and better log volume controls — prioritizing Deloitte’s environment for rollout.
KINDO HAS TODAY NEEDS EXTENSION GAPS Grafana Cloud Operational health, ingress, Hatchet task execution Langfuse LLM-level tracing: prompts, tool selection, model calls Audit Logs Syslog/DB, CSV export, meta-auditing (CCRC) Turnkey SMK Auto-forwards to CloudWatch Logs + X-Ray traces Conversation Compaction Recently shipped — reduces context overflow failures Run Status Tracking Exists but stuck on failure ENG-10858 fix in progress 2026.07 Release Execution durability + log volume controls incoming Durable Log Backend Logs roll over in ~20 min — evidence lost before investigation Structured Failure Reasons Why did the agent stop? Tool error / timeout / overflow Debug Bundle Export One-click failure evidence for L1 triage (no infra access) Token / Cost Attribution Per-step and per-run usage tracking and reporting Dashboard Replication Grafana JSON + OTEL docs for self-hosted monitoring Available today Partially exists — needs extension Gap — not yet available
Desired Outcomes
Durable logs that survive investigation windows · Structured failure reasons per agent run · Per-step and per-run token/cost attribution · Self-serve debug bundle export from failed runs · Replicable monitoring dashboards for on-prem environments
Discussion Points
Timeline for observability backend wiring and debug bundle capabilities · Feasibility of sharing Grafana dashboard configuration as a near-term deliverable · Priority sequencing: log durability vs. failure diagnostics vs. token tracking
PRIORITY 2 MCP Tool-Calling & Agent Step Latency
The SOC Level-1 triage agent takes 10–15 minutes per ticket compared to 3–8 minutes on the prior approach. The June 29 review confirmed the primary driver is MCP tool-call retries — the agent selects an incorrect tool, fails, reasons about the failure, and retries with a different tool.
Desired Outcomes
Triage agent completing in under 8 minutes per ticket · Reduced tool-call retry loops through better tool scoping · Visibility into which tool calls are failing and why · Benchmarked inter-step framework overhead
Discussion Points
Follow-up on June 29 agent architecture review and recommendations · Feasibility of per-step tool scoping to reduce selection errors · Realistic target latency and the split between platform improvements vs. prompt optimization
PRIORITY 2 Deterministic Flow Control & Automatic Retry
SOC agents require conditional routing (e.g., EPDR detection → EPDR skill file, XDR → XDR skill file) and automatic recovery from transient failures. Today, routing is handled implicitly through LLM reasoning rather than deterministic logic, and any step failure requires manual re-run.
Desired Outcomes
Conditional branching between agent steps · Loop/iteration for batch processing · Configurable automatic retry per step on transient failure · Parallel execution of independent operations
Discussion Points
Product direction for flow control: visual workflow builder vs. enhanced step primitives · Auto-retry timeline and configuration model · Interim architectural patterns available today (multi-agent chaining, classification-first routing)
Connecting Thread
These three topics are interconnected: MCP tool-call retries inflate latency, but diagnosing which tools fail requires observability that doesn't exist yet, and preventing retries entirely requires deterministic flow control that isn't available. Solving any one accelerates the others.
Kindo

Kindo × Deloitte — Program Meeting · July 22, 2026