Knowledge Base

Knowledge documents live in knowledge/ as Markdown files. They teach the agent about your domain — environment, baselines, procedures, patterns.

knowledge/
├── environment.md
├── baselines.md
├── team.md
└── response-procedures.md

Document Format

# Knowledge: Normal Traffic Patterns
 
- Weekday: 2,000-4,000 RPS (peak 12-2 PM EST)
- Weekend: 800-1,500 RPS
- Error rate: < 0.05% on api-gateway
- Deployment windows: 10-11 AM, 3-4 PM (brief spikes expected)
- Black Friday: 15,000-25,000 RPS (sustained 12 hours)

The first # Heading becomes the title. The filename (without .md) becomes the document name/ID. Everything after the heading is the body.

Categories

Knowledge documents cover these categories:

Category	What	Typical Source
system_docs	API endpoints, auth, response formats	Auto from connections
methodology	What the data means, how to interpret it	Author writes
patterns	Known patterns worth detecting	Author seeds, agent discovers
false_positives	Known benign anomalies	Agent discovers, author approves
response_procedures	SOPs, escalation paths	Author writes
environment	Infrastructure layout, inventory	Author writes
baselines	What "normal" looks like	Author seeds, agent refines
team	Contacts, preferences, escalation paths	Author maintains
incident_history	Past sessions, resolutions	Agent proposes
working_memory	Agent's persistent context	Agent maintains

On-Demand Loading

The agent starts each session with a compact KB index (~400 tokens for ~20 docs). Full documents are loaded via load_knowledge only when needed. Task agents load their own docs independently.

Learning Flywheel

The agent proposes knowledge updates via propose_knowledge:

Agent discovers something the KB doesn't know
Proposes an update (new doc or edit)
Goes through approval policy (manual review or auto-approve per category)
Next session starts smarter

Configure approval policies in the Admin UI.