We built a read-only AI agent for DevOps lookups and first-pass incident triage. Here's what worked, what didn't, and how we kept the model away from the security boundary.