Nirna.AI

The AI support engineer for production.

Cited evidence using logs, deploys, data, code and features. A recommended fix.

Customer-hosted or on Nirna cloud. Your model. No lock-in.

SUP-4729 · Escalated · L2 · 14 min ago
Users can’t log in since this morning
Nirna.AI posted 39s after escalation
New pattern High confidence

3 accounts hitting the same KeyError('sub') in validate_token since the token-rotation deploy at 09:42 UTC.

  • LogsPOST /auth/verify raises KeyError: 'sub' at tokens.py:59, 3 accounts in 32 min
  • Datanew_token_rotation enabled for all 3 in feature_flag_overrides
  • Code_rotate_claims drops the subject — allowlist omits 'sub' — tokens.py:37–45 @ 76b3ab8
  • Deploy76b3ab8 changed tokens.py on the failing call path at 09:42 UTC
Blast radius 3 accounts affected, all with the flag on. Every login on those accounts, not a subset of users.
Recommended fix Add "sub" to the allowlist in _rotate_claims (tokens.py:37–45), and guard the subject read in validate_token (:48–60).
Helpful?

Questions we get asked

What access does Nirna need?

Read access to your tracker, logs, database and repository. The database connector expects a read-only role.

Can it change anything in our systems?

It posts a comment on the ticket. It does not change statuses, assign owners, touch your database, alter data, or push code. If posting is unacceptable, turn it off and read briefs in Nirna’s own UI; the triage is identical.

Can the AI invent a cause, or a citation?

The verdict and the shape of the fix are computed from scored evidence before the model is called. The model writes the prose; it cannot promote a verdict or turn “needs more information” into a diagnosis.

Citations are bound to evidence that was actually collected. Links and commit SHAs are read from that evidence rather than written by the model, and a citation matching nothing is dropped rather than shipped.

Does customer data go to a third party?

Classification, clustering, correlation and scoring happens within Nirna.

The provider is your choice. Data privacy and compliance policies present in your existing enterprise contract with the model provider applies

What about PII and secrets?

Evidence passes through a single masking boundary before the model sees it. Values become stable pseudonyms rather than [redacted], so the reasoning survives without the identity.

It masks by shape (keys, tokens, emails) and by field label, which is what catches PII with no recognisable form: phone numbers, display names, free-text addresses. Then it re-scans, and halts rather than emit a brief with a credential in it.

Where does it run, and is it multi-tenant?

In your VPC or on Nirna cloud. It is single-tenant by construction: one instance per customer, enforced in code rather than by policy. No possibility of access or leakage across tenants

How do we know when it’s wrong?

Every brief shows the signals that fired, with their strengths and the ones that did not. A brief with thin evidence says so and asks for what it needs, instead of guessing confidently.

Rate any brief and the correction feeds back into the weighting.