Honeycomb

Connectors let the Canvas Agent act in a dozen outside services under each person's own account: it reads and updates issues, projects and comments in Linear, runbooks in Notion, feature flags and targeting rules in LaunchDarkly, and charts and cohorts in Amplitude, manages support issues in Pylon, and reads incidents and on call schedules in PagerDuty and incident.io, Jira issues and Confluence pages, GitHub repositories and Sentry stack traces.

Inside Honeycomb it holds write tools that create boards, SLOs and triggers. Connector tools stay out of automatic investigations, which work on telemetry alone.

Sourcedocs.honeycomb.io/investigate/canvas/connectorsread 2026-11-09

An investigation runs as a loop of queries the agent plans and executes across traces, logs, metrics, SLOs, triggers and BubbleUp, drawing on connected tools and on any skill whose description matches the problem, until it can explain what changed and why.

Several agents can work one investigation at once, since each person's chat on a shared canvas is a separate agent carrying its owner's context.

Repeat firings of the same alert return to one investigation for up to 30 alerts or a week, so the agent builds on its earlier findings, and a firing that lands mid run is skipped until the current pass concludes.

Sourcedocs.honeycomb.io/investigate/canvasread 2026-11-09

Each investigation assembles its context at run time from the customer's telemetry, dataset and field schemas, sample values, boards, SLOs and triggers. Connectors let the agent read runbooks in Notion, Confluence pages through Atlassian and incident timelines in PagerDuty or incident.io once a person has linked their account, and team skills carry written procedures for it to follow. Nothing here builds a standing index over the customer's documents, and automatic investigations reach no connector at all, so runbooks kept outside Honeycomb never inform an unattended run.

Sourcedocs.honeycomb.io/investigate/canvas/connectorsread 2026-11-09

Every connector tool, and every Honeycomb write or destructive tool, carries a per person setting of Always allow, Ask or Never.

Write tools, destructive tools and tools Honeycomb has not yet reviewed default to Ask, so the agent pauses on an approval prompt naming the tool, and the person approves that single call or denies it with a reason and an alternative. Approval never carries over to the next call.

Read only members see these settings without changing them, team owners switch skills and Honeycomb Intelligence on or off for everyone, and a request to forget a memory waits for approval before anything is removed.

Sourcedocs.honeycomb.io/investigate/canvas/connectorsread 2026-11-09

Pro and Enterprise teams can turn on single sign on, and every team carries roles running from owner to read only: owners switch Honeycomb Intelligence, skills and other AI features on or off for everyone, while read only members see tool approval settings without changing them. Honeycomb completes an annual SOC 2 Type II audit with independent penetration testing, files a CSA STAR Level 1 questionnaire, attests to PCI DSS as a merchant, signs HIPAA business associate agreements on Pro and Enterprise, offers a GDPR data processing agreement and runs on ISO 27001 certified AWS and Google Cloud environments, with reports held in a trust center.

Sourcedocs.honeycomb.io/authentication-and-security/complianceread 2026-11-09

Every query the agent writes stays visible in the investigation, where anyone can read its exact syntax, open it in the Query Builder, edit it or share a link to it. Investigations save automatically as persistent workspaces, filterable by automatic, trigger, SLO, anomaly, team and personal runs, and each teammate's chat with the agent can be opened from the Team tab. Approval prompts in the chat name each tool the agent asked to run, and Enterprise activity logging shows who or what changed a given resource configuration.

Sourcedocs.honeycomb.io/investigate/canvasread 2026-11-09

Memory, a beta switched on team by team, keeps facts about the customer's systems that Canvas saves on its own during an investigation or that a person asks it to keep, such as which dataset answers questions about a payment queue.

Each memory belongs to one person on one team, stays even from owners and admins, and can be viewed, edited, searched and deleted singly or in bulk, with deletes final; Honeycomb does not support beta features for production use.

Outside that beta, state carries across runs only inside one alert's investigation, which absorbs up to 30 firings over a week, and automatic runs neither read nor save memory.

Sourcedocs.honeycomb.io/investigate/canvas/memoryread 2026-11-09

Customers choose at signup whether Honeycomb stores their data in its US location or its EU location, each with its own app and API endpoints, and the subprocessor list names Amazon Web Services as the host in both regions.

Enterprise plans add support for Honeycomb Private Cloud, which runs Honeycomb in a dedicated environment, plus AWS PrivateLink for private connections into the service.

Canvas calls models from OpenAI and AWS Bedrock, with the offline models hosted through Bedrock so the model maker never sees the input, and OpenAI and Anthropic both appear on the subprocessor list as US entities.

Sourcedocs.honeycomb.io/authentication-and-security/complianceread 2026-11-09

Nine built in skills ship with Canvas and cannot be removed or edited: production investigation, SLO and trigger design, query patterns, metrics queries, board creation, conversation investigation for AI sessions, an agent instrumentation audit, observability fundamentals and a summary of any canvas. Each one is a set of instructions for the same Canvas agent rather than a separate agent doing its own job. Teams write their own skills in the Agent Skills format, keep them private or share them, and owners can switch any built in skill off for the whole team.

Sourcedocs.honeycomb.io/investigate/canvas/skills.mdread 2026-11-09

Alert events start the agent without a person. Automatic investigation can be switched on for up to 25 triggers, 25 SLO burn alerts and 25 anomaly detections, each configured on the alert itself, and when the run completes the alert notification carries an Investigate link straight to the findings. People start investigations from a plain language prompt, from any query in the Query Builder, from a chat about the page they are viewing, or from Slack, where the Canvas app lets teams start and follow investigations. Turning on Honeycomb Intelligence for the team is the one prerequisite.

Sourcedocs.honeycomb.io/investigate/canvas/auto-investigate.mdread 2026-11-09

Canvas runs on models from OpenAI and AWS Bedrock that Honeycomb selects, and a single Honeycomb Intelligence feature may call several models from different providers as Honeycomb tests new releases. Offline models are self hosted through Bedrock, so the underlying maker never sees the input, and no provider in use trains foundation models on customer data. Customers get no model setting in Canvas. The Honeycomb MCP server runs on whatever model the client assistant brings, which belongs to the customer's own tool rather than to Canvas.

Sourcedocs.honeycomb.io/security-compliance/ai-policies.mdread 2026-11-09

Honeycomb's API runs on separate US and EU hosts, and Enterprise plans add a Query Data API and an SLO Reporting API for pulling query results and SLO status into other systems. The hosted Honeycomb MCP server, on every plan including Free, lets a client the customer picks create, read and update Honeycomb queries and any other Honeycomb entity, and lets that client read the person's Canvas memories, so a coding assistant can investigate production from the editor with the same data Canvas uses.

Sourcedocs.honeycomb.io/authentication-and-security/complianceread 2026-11-09

For teams running their own AI agents, Agent Timeline and the built in conversation investigation skill trace sessions captured through OpenTelemetry GenAI conventions, so engineers can follow what an agent did after something goes wrong, and an agent instrumentation audit skill flags gaps in an agent's telemetry. Scoring lives elsewhere: the Braintrust connector reads eval results, logs and traces kept in Braintrust, and Canvas brings them into an investigation beside Honeycomb data. Canvas findings show the queries behind them for people to check.

Sourcedocs.honeycomb.io/investigate/canvas/skills.mdread 2026-11-09

Canvas works through Honeycomb's query engine and connector APIs and never drives a browser or desktop. The Checkly connector reads synthetic checks, results and status pages that Checkly itself runs, and frontend observability ties user experience in the customer's web application to backend behavior, but neither puts the agent in front of a screen. Investigations run on Honeycomb infrastructure against telemetry the customer has already sent, and any change outside Honeycomb goes through a connector tool call.

Sourcedocs.honeycomb.io/investigate/canvas/connectorsread 2026-11-09