Unusual operational changes found and explained, without a single line of SQL

Executive summary

TNBT Tech needed a faster way to investigate its operational data and spot unusual changes or patterns. Every investigation depended on technical staff to identify the data, write SQL, run several queries and interpret the results. DevOps TechLab deployed QueryDash, its agentic investigation platform built on Amazon Bedrock, so users can ask operational questions in plain language and receive data-backed findings, with every query validated as read-only before it touches production data.

Client

TNBT Tech · Operations

Business problem

Investigating unusual operational changes meant manual SQL across many queries, run by technical staff.

What we delivered

An AI investigation agent (QueryDash) on Amazon Bedrock with Amazon Nova Pro, connected read-only to TNBT Tech’s operational data.

Engagement

Discovery, build and onboarding, then managed operations and continuous optimisation by DevOps TechLab.

Outcome

Teams ask operational questions in plain language and get data-backed answers about what changed and why.

The business challenge

TNBT Tech’s traditional analysis required technical teams to manually identify the relevant data, prepare SQL, execute multiple queries and interpret the results. Complex investigations took time and depended heavily on technical resources.

Why it mattered

• Anomalies found late

  Spotting an unusual change, and its likely cause, needed a technical investigation every time.

• Dependence on a few specialists

  Only people who could write SQL could investigate the data, so questions waited for them.

• Many queries per question

  A single operational question could need several queries and manual comparison of the results.

• Causes hard to connect

  Linking a change to its likely cause meant relating several operational data points by hand.

What TNBT Tech set out to achieve

1. Let teams ask operational questions in natural language, without writing SQL.
2. Find unusual changes and their likely causes through multi-step analysis.
3. Return data-backed findings that people can act on.
4. Keep the context of an investigation for follow-up questions.
5. Remove any risk to production data from AI-generated queries.

The solution: an AI investigator for operational data

Users describe the objective in plain language, for example “Identify unusual operational changes and determine their likely causes.” The agent interprets the objective, discovers the data it needs, generates and runs validated queries, analyses the results and decides whether more investigation is needed, recovering on its own when a query fails.

Key design choices

• Managed generative AI

  Amazon Bedrock with Amazon Nova Pro handles reasoning and tool use. There are no models to host and no GPU infrastructure to run.

• No servers to manage

  The application runs on Amazon ECS on AWS Fargate behind an Application Load Balancer, so it scales with demand.

• Works on the data where it lives

  The agent queries the existing operational databases directly, read-only, instead of copying data into a new warehouse.

• Investigations that remember

  Amazon DynamoDB keeps the conversation and investigation history, so follow-up questions build on what the agent already found.

Security and governance

For leadership, the first question about AI on production data is risk. The platform is built so that AI-generated queries never touch the database directly.

• Read-only by design

  Only read statements (SELECT, WITH, SHOW, DESCRIBE, EXPLAIN) are allowed. Any write or schema change is rejected before it runs.

• Validated before execution

  Every query the AI writes passes through a server-side validation layer. The model never has a direct line to production data.

• Protected performance

  Results are capped, so a broad question cannot turn into a runaway query on a production database.

• Managed credentials

  Database credentials sit in AWS Secrets Manager, and access is governed by AWS IAM roles, not stored in code.

Architecture on AWS

Click to enlarge

How we delivered

1. 01Discover

   Mapped the questions TNBT Tech’s users need answered, the data behind them and how it relates, and defined secure, read-only access to production.

2. 02Build & onboard

   Connected TNBT Tech’s data, configured Amazon Bedrock and Nova Pro, set up read-only validation, conversation memory and real-time streaming, and tested against representative investigation scenarios.

3. 03Run

   DevOps TechLab operates the service: monitoring the application, the AWS environment and the agent, supporting queries and resolving production issues.

4. 04Improve

   Ongoing tuning of agent planning, query generation and recovery, plus reviews of performance, cost and security as new questions are added.

Business outcomes

TNBT Tech’s teams now move from “something changed” to a data-backed explanation in one conversation, instead of a chain of requests to technical staff.

• ✓
  Self-service investigation

  Teams investigate operational data themselves, in natural language, without SQL.

• ✓
  Anomalies with likely causes

  The agent identifies unusual changes and works through the data to find their likely causes.

• ✓
  Evidence for every finding

  Answers come with the data behind them, so teams can act with confidence.

• ✓
  Zero write access to production

  AI-generated queries are validated and read-only, so production data is never changed by the agent.

• ✓
  Less dependence on SQL specialists

  Fewer manual SQL investigations for technical staff, on a platform that extends to new questions.

What’s next

Because the architecture is reusable, TNBT Tech can extend the agent to new business questions without building a separate analytics workflow for each. DevOps TechLab continues to advise on new investigation scenarios and further opportunities for AI-driven automation.