Design an Incident Response Agent

The incident below is invented. A checkout service's error rate rises from 0.5 percent to 12 percent within two minutes. An agent reads the alert, sees that the database is slow, and proposes to restart the checkout service. The on-call engineer approves the restart within 30 seconds, because the proposal looks reasonable and the error rate is still rising.

The restart empties the service's caches, so every request now reaches the slow database, and the error rate climbs to 30 percent. The real cause was a configuration change deployed 21 minutes earlier. Nobody had asked what changed.