The LLM narrates. The code decides.

Short summary

Instead of letting an LLM make judgment calls on monitoring alerts, the author restricts it to narrating results that deterministic Python code has already classified and validated. The architecture keeps the LLM off the critical path—alerts deliver instantly while narrated annotations arrive later as a non-blocking amenity, with fallbacks ensuring no alert is ever lost. The core lesson: push every operational decision into testable code, constrain aggregatable output to enums, and treat the model as the most replaceable stage in the pipeline.

• •LLM should narrate alert context, not classify or decide root cause—deterministic code handles all operational logic
• •Architecture keeps model off critical path: raw alerts deliver instantly, narrated annotations arrive later with full fallback
• •Treat LLM as last, most replaceable pipeline stage; if you can swap it out and data stays clean, the design is correct

Generated with AI, which can make mistakes.