# Ace investigations: start with the alert, get a cause you can check

> Infrastructure, telemetry and code agents work in parallel and share what they find. Your engineers get the evidence, the open questions and a proposed fix without running every search themselves.

## How an Ace investigation works

1. **Start from the alert.** Ace opens a case from the failing signal and the service it names. Further alerts for the same workload, from any source, join that case instead of opening new ones.
2. **Split the work.** Telemetry follows the failing request, Infrastructure checks the resources and dependents behind it, and Code tests recent changes against the findings.
3. **Share findings.** Agents write to one shared incident record, and a finding from one redirects the others. For example, a database lock finding sends the trace search to the session that holds it. When significant new evidence arrives, the investigation continues.
4. **Test the explanation.** Hypotheses are checked against contradictory evidence. Unresolved questions stay visible next to the diagnosis.
5. **Propose the fix.** Ace prepares a pull request or a supported action with the exact target, the evidence and recovery checks.
6. **Verify and remember.** Ace rechecks the original symptoms, keeps the case open if they remain and retains the lesson, so similar incidents anywhere in your organization start from it.

## Understand the fix before you approve it

Trace the patch back to the failure it addresses. Review the target, the tests and the recovery checks before a change reaches production.

## Before you connect Ace

**Does Ace need write access to investigate?**
Investigation starts with scoped, read-only access to connected sources. Actions have separate permissions and review requirements.

**Can engineers inspect the evidence?**
Findings retain their source context, so engineers can examine the evidence behind the diagnosis and proposed action.

**How do we decide what Ace can do?**
Your team selects the actions, target systems and approval requirements. Start with read-only investigations and expand that scope after reviewing the results.

## Further reading

- [A slow database, a waiting migration and the evidence between them](https://tryace.dev/resources/evidence-backed-root-cause-analysis): a worked root cause analysis.
- [Audit your alerts in one afternoon](https://tryace.dev/resources/audit-your-alerts): find the noisy pages and the missing alerts.