Kiro's 250 Monthly Incident Investigations: What Nine Subscriptions Buy

The Published Operating Result

Kiro says a representative month delivered about 250 unattended production investigations at a median 13.6 minutes each for a bill equivalent to nine of its top-tier subscriptions. That ratio is useful because it connects agent spend to completed operational work, but it does not mean any organization can replace on-call engineering with nine seats. The system relies on curated skills, read-only tools, knowledge maintenance, concurrency limits, and human judgment.

The August 21 Kiro account describes a real alarm diagnosed in 13 minutes and 35 seconds. It reports that 96.9% of tool calls are reads, that the skill catalog contains 107 playbooks, and that strong models lead investigations while cheaper models handle fan-out. Humans still decide escalation, severity, resolution, and consequential changes.

Calculate Cost per Defensible Brief

Use the finished, evidence-linked investigation brief as the unit of output. Divide model credits, dispatcher infrastructure, logs and metrics queries, retained traces, knowledge maintenance, and reviewer time by briefs that meet the acceptance rubric. Do not count a ticket touched or a session launched as success. Failed, duplicate, and abandoned investigations remain part of total cost.

Then estimate labor returned: time to orient, query multiple systems, rule out hypotheses, write the ticket, and wake the right owner. Separate hours shifted from hours eliminated. Engineers may spend less time gathering evidence but more time reviewing concise decisions and fixing root causes. That change can be valuable even if the on-call rotation remains intact.

Progressive Disclosure Controls Tokens

Kiro keeps only an index of skills in always-loaded context and opens the relevant playbook for the incident. Past investigations live in a searchable archive rather than a giant system prompt. This design reduces context exhaustion and makes each token more likely to affect the active hypothesis. Reproduce the pattern with a small operational map, task-specific skills, and retrievable evidence.

Measure retrieved bytes, useful citations, repeated queries, context compactions, and sessions that time out before a conclusion. A knowledge base is not free: documents must be corrected, deduplicated, access-controlled, and reindexed. Charge that maintenance across investigations. When one stale sentence causes repeated bad tickets, fixing the source is often more economical than buying a stronger model.

Bound Autonomy by Action

Read-heavy triage is a strong autonomy candidate because queries are reversible and parallelizable. Ticket resolution, severity changes, deployments, and production writes have different consequences. Define rules per action rather than one global autonomy setting. Mint session-scoped read-only credentials and make unauthorized mutation fail at the infrastructure layer, not merely in the prompt.

Use conditional writes and stable incident keys so several agents do not file duplicate escalations. Add session timeouts, stuck detection, and a concurrency ceiling. Escalate ambiguous judgments to a small cross-provider panel only after evidence is collected; model councils are expensive and correlated. Disagreement should trigger more investigation, not a majority vote detached from facts.

Pilot With One Queue

Choose a repetitive alarm family with good telemetry and documented resolution patterns. Run the agent in shadow mode for several weeks. Compare time to first defensible diagnosis, hypothesis coverage, factual errors, duplicate actions, human review minutes, and incident outcome. Require every claim to link to a query or immutable source. Concise summaries belong on visible tickets; full trajectories belong in the worklog.

Only expand after accepted briefs show stable quality and the knowledge-maintenance load is understood. Nine subscriptions may be an attractive monthly bill for Kiro's workload, but the transferable advantage is structural: bounded read access, progressive context, evidence-backed claims, cheap fan-out, and humans at consequential decisions. Price the whole operating system, then compare it with the exact on-call work it changes.

Account for the Knowledge Flywheel

Create a decision record for the operational skill and investigation archive. Capture setup hours, skill edits, retrieval hits, stale-document corrections, lessons accepted or archived, review minutes, and changes in repeat-incident cost. Store the record with the accepted artifact rather than only in a temporary model transcript. This evidence lets engineering reproduce an outcome, finance explain the bill, and reviewers distinguish a real improvement from a lucky run. It also makes exceptions visible instead of allowing them to become undocumented defaults across future sessions.

The main failure to avoid is that low monthly inference spend hides a knowledge base that requires constant expert repair. Define an owner, a measurable threshold, and an expiry date for the decision. measure whether recurring alarm families become faster and need fewer corrections. When evidence falls outside the approved range, stop expansion, preserve state, and investigate before buying more attempts. This operating discipline converts a one-time technique into a bounded policy that can remain economical as models, tools, teams, and repositories evolve.