- We already use Robusta or PagerDuty automation. Why Reflex?
- Robusta and PagerDuty automation both require you to write playbooks or scripts for each scenario you want to handle. Reflex ships with curated patterns for the most common breach types out of the box, and the trust ladder lets you graduate from observe → dry-run → auto at your own pace. Reflex notifies via Slack the same way Robusta does; you can run them side-by-side and pick whichever wins.
- What if Reflex remediates wrong?
- Every Reflex starts in observe mode — it tells you what it WOULD do without doing anything. You promote to dry-run (Slack approval required for each action) only when the recommendations look right. Auto mode is the top rung — you climb it on your timeline. Until you promote, Reflex never touches your cluster.
- Won't this cause cascading failures?
- Each Reflex has a cooldown (default 10 min) so it can't loop on itself. Preconditions block actions when the system is unhealthy (already at max replicas, recently-failed action, etc.). Auto mode honors a global rate limit. And if the action goes sideways, the next observe/dry-run cycle catches it before it compounds.
- What if the AI hallucinates?
- Reflex tries curated patterns first. The AI reasoner only runs when no pattern matches, and only on Pro tier. AI output is JSON-validated, has a hardcoded 500-token ceiling, and is shown to a human before any action. You can disable AI entirely with
--set ai.enabled=false. AI cost per call is logged so you can watch it in your Grafana. - Can I run this air-gapped?
- Yes. Reflex Runtime is a single self-hosted controller; the free tier has no external dependencies. Pro tier's AI reasoner is BYOK — bring your own OpenAI/Anthropic key, or proxy through your enterprise gateway. License validation is offline after the first install.
- What happens if my license expires?
- You drop back to community-mode (3 SLOs, observe only). Existing higher-tier resources keep running but won't be replaced. No data is lost; no cluster is touched. Re-applying a fresh license restores your tier instantly.
- Where does my data go?
- Nowhere by default. Reflex Runtime ships in-cluster; metrics stay in your Prometheus, breach events stay on-disk in your cluster, recommendations and actions stay in your Kubernetes API server. The only outbound traffic is Slack webhooks (if you configure them) and the AI reasoner (if you enable it, BYOK). No phone-home telemetry.