Kestrel NL‑to‑DAG Incident Responder

connecting llm: local stub read-only by default

1 · Incident (natural language)

Inject prompt-injection breaks it

Guardrails

Writes permitted policy layer Auto-approve writes unsafe

Step pacing 45 ms/line

Action whitelist

System prompt

2 · Generated workflow DAG no plan

⚠ Approval required — this step WRITES to the cluster

Planner output json, streaming

3 · Executor idle

Cluster (simulated kind)

4 · Audit trail