Three parts: probes, the center and action channels. Below — what each does and why automation stays under the operator’s control.
Light agents on your servers and VMs — inside the AS, on the border, in branches — plus public probes in other networks. They measure, receive flow and SNMP, hold a session with the border and talk to CGNAT through its API. Read access uses minimal rights; rights to change are stored separately and applied only for clearly defined actions.
Receives data, correlates it across probes (quorum), keeps history and memory, classifies, builds explanations and suggestions. Every decision has a reason in the journal.
Panel, Telegram — separate groups for the NOC and for support, — Web Push, border (BGP), CGNAT (profiles), API. Automation acts within ceilings and exception lists; anything it did can be undone with one button.