PrimeOps Multi-Tenant ITSM and AIOps Platform
An ITIL v4 aligned service management and IT operations platform for managed service providers and enterprises, with a governed layer of AI agents for incident triage and remediation.
Solution Overview
PrimeOps is an IT service management (ITSM) and IT operations platform aligned with ITIL v4. It is built for managed service providers (MSPs) that run many customer organisations from one deployment, and for enterprises that operate IT across business units.
Each customer keeps its data in its own database schema and its own identity realm. Provider staff work across the customers they are entitled to from a separate console and a cross-tenant network operations centre (NOC) view. Workflows, SLA policies, forms, approval chains and configuration item classes are stored as versioned configuration, so a new customer is onboarded through configuration in place of custom scripts.
| Customer | Situation | Probable root cause | State |
|---|---|---|---|
| Customer A | Web tier latency | Database host, disk saturation | Approval needed |
| Customer B | Mail queue growth | Relay service stopped | Fix verified |
| Customer C | VPN gateway flapping | Interface errors on edge switch | Diagnosing |
| Customer D | Certificate near expiry | TLS certificate, 7 days left | Incident raised |
Operational Challenges Addressed
Managed service margins depend on how many customers each engineer can support, while alert volumes in IT and security operations continue to rise. Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 20261, which raises the question of how such agents are controlled on production infrastructure.
Licence Cost Against Service Margins
Per-agent and per-module licensing makes the service platform a growing cost on every customer account as discovery, asset, operations and AI functions are enabled.
Customisation Debt
Customer-specific scripts and business rules accumulate across an MSP's customer base, slowing each upgrade and each new onboarding.
Multi-Tenancy Added Later
Platforms designed for a single enterprise add customer separation afterwards, which complicates cross-customer operations and the isolation of data and access.
How PrimeOps Works
The sequence below follows a monitoring alert from intake to a verified fix. The event management and workflow engines perform the first four steps. The agentic layer performs the remainder and acts on customer infrastructure only through the platform's automation engine and its guard chain.
Ingest Event
Signed webhook per customer
Normalise and Bind
De-duplicate and map to a configuration item
Correlate Situation
Topology and probable root cause
Open Alert Lifecycle
Rules may raise an incident
Open Agent Episode
Trace identifier assigned
Triage and Diagnose
Read-only probes
Propose Fix
Closed menu of vetted automations
Autonomy Gate and Approval
Risk tier, autonomy, budget; one or two approvers where required
Pre-Launch Guard
Alert re-read; held if cleared or changed
Execute in Sandbox
Guard chain and ephemeral credentials
Verify the Fix
Alert confirmed as cleared
Notify and Record
Trace, audit trail and scorecards
Platform Modules
The platform is organised in five layers within one deployment, using one tenancy model, one identity system and one configuration management database (CMDB).
Service Management (ITIL v4)
- Incident management
- Problem and known errors
- Change and CAB approval
- Service catalog and requests
- Knowledge management
- SLA management
- Self-service portal
- Service status board
Configuration, Assets and AI Assistance
- CMDB with 62 CI classes
- Hardware assets
- Software assets
- Discovery and edge collector
- Similarity and classification
- Generative assistance
- Ops Copilot
Event Management and Automation
- Event intake and noise control
- Situation correlation
- Metric and baseline rules
- Cross-tenant NOC
- Sandboxed automation
- Auto-remediation
Agentic AIOps
- Agent runtime
- Autonomy dial
- Pre-launch guard
- Replay gate
- Scorecards
- Knowledge miner
- Security triage
- Vulnerability remediation
- Command Center
Platform Foundation
- Schema-per-customer isolation
- Role-based access
- Configuration Studio
- Reporting
- Integration hub
- Notifications
- Field-level audit trail
Key Capabilities
Incident, Problem and Change
- Incident lifecycle with priority matrix and major-incident handling
- Problem records with root-cause analysis and a known-error database
- Standard, normal and emergency changes with risk scoring and CAB approval
- Conflict-aware change calendar, freeze windows and unauthorised-change detection
Requests, Knowledge and SLA
- Service catalog held as configuration, with forms, approvals and task fan-out
- Knowledge lifecycle with semantic search and gap detection
- Calendar-aware SLA targets with pause and breach detection
- Branded self-service portal for each customer
CMDB and Assets
- 62 governed configuration item classes with typed relationships
- Impact traversal, identification and reconciliation
- Hardware lifecycle, depreciation, stockroom and certified disposal
- Effective licence position with Oracle core-factor and IBM PVU calculators
Discovery
- Network sweep, SSH, SNMP v2c and v3, WinRM and Redfish
- LDAP, Active Directory and TLS certificates
- Docker and Kubernetes
- Edge collector with store-and-forward
Event Management
- Signed webhook intake, de-duplication and CI binding
- Topology correlation into situations with a probable root cause
- Change correlation and maintenance-window suppression
- Flood control, metric thresholds and baseline rules
Sandboxed Automation
- Network egress denied by default, with ephemeral credentials
- 46 prepared automations
- Per-customer auto-remediation of vetted alert signatures
- Guard chain applied before each execution
AI Assistance
- Self-hosted embedding model for similarity, duplicates and classification
- Generative summaries, draft replies and knowledge articles
- End-user assistant and Ops Copilot for provider staff
- Personal data redacted before any external model call; enabled per customer
Security Operations
- Wazuh alert intake, enrichment and triage
- Containment actions subject to approval
- Links between user reports and machine-detected situations
Vulnerability Remediation
- Trivy scanning, with findings ranked by CMDB exposure
- Patched containers built and tested in a sandbox
- Promotion through a platform change with approval
Multi-Tenant Architecture
Multi-tenancy is part of the platform foundation. An MSP administrator creates a customer from the provider console. In a single transaction the platform creates the customer's schema, applies the tenant template and seeds default workflows, SLAs, forms, roles, catalog and notifications; any failure rolls back the whole operation. Customer administrators then adapt the configuration in the Configuration Studio, where each change is validated, versioned and can be rolled back.
Governed AI Agents
The agents use the same controls as human operators. They choose actions only from a closed menu of vetted automations, alert content is treated as untrusted data, and an action is never executed on a verdict produced by a fallback language model. A new agent version runs in shadow mode and is promoted only after passing a replay evaluation against recorded cases. A kill switch, circuit breakers and per-episode budgets apply to every agent.
- Entitlement
- Role
- Parameters
- Blast radius
- Rate limit
- Approval
| Agent or Function | Role | Autonomy |
|---|---|---|
| Triage | Classifies incoming alerts and proposes a vetted fix; delegates to diagnosis below a confidence threshold | Autonomous for tier-1 actions |
| Diagnosis | Runs read-only probes through the automation engine to establish the cause | Shadow |
| Security Analyst | Enriches and triages Wazuh security alerts and proposes containment | Supervised; containment always requires approval |
| Vulnerability Remediation | Ranks findings by CMDB exposure, builds and tests a patched container, and promotes it through a change | Change approval required |
| Knowledge Miner | Turns resolved episodes into draft runbooks | Drafts for human review |
| Communications | Notifies affected users after a fix is verified | Autonomous |
Comparison with Typical Approaches
| Capability | Typical Approach | PrimeOps |
|---|---|---|
| Multi-tenancy | Customer separation added to a single-enterprise design | Schema and identity realm per customer, separate provider plane and cross-tenant NOC |
| Customer onboarding | Customer-specific scripts and business rules | One transaction plus configuration, across 37 versioned configuration types |
| Product scope | Separate products for ITSM, CMDB, discovery, AIOps and automation | One deployment, tenancy model, identity system and CMDB |
| AI agents | Chat assistants on the ticket queue | Agents act through the same guard chain, approvals and audit trail as staff, with per-customer autonomy |
| Vulnerability remediation | Severity-ordered finding lists passed to operations teams | Findings ranked by CMDB exposure; container patches promoted through change control |
| Deployment | SaaS only, or self-hosted editions being withdrawn | Managed service, customer cloud account or on premises |
Atlassian states that its Data Center products, including Jira Service Management Data Center, reach end of life on 28 March 20292. Organisations reviewing self-hosted service management can include PrimeOps in that assessment.
Intended Users
MSP Leadership
Reviews margin per engineer, tool consolidation and platform licence cost.
Head of Service Delivery
Manages per-customer SLAs and processes, multi-tenant views and customer portals.
NOC and SOC Teams
Handle alerts, cross-customer correlation and incident reporting timelines.
Enterprise CIO or CTO
Assesses platform cost, data residency and evidence for regulatory audits.
CISO or Compliance Head
Requires evidence for obligations such as CERT-In incident reporting3 and the RBI IT governance directions4, and tracks vulnerability remediation.
Service Desk Agents
Handle tickets, requests and changes on a daily basis.
Security and Data Protection
| Control | Implementation |
|---|---|
| Customer data isolation | Schema per customer; the customer is resolved on the server and never taken from client input |
| Identity | Separate identity realm for each customer and for the provider, with separate authentication for customers, staff, machine clients and edge collectors |
| Access control | Deny-by-default permission catalogue enforced on every endpoint; AI agents have their own identity |
| Audit trail | Field changes recorded with actor, time and before and after values; no hard deletes; agent actions recorded with a full reasoning trace |
| Automation safety | Namespace sandbox, egress denied by default, ephemeral credentials, blast-radius and rate limits, approval chains |
| AI safety | AI off by default per customer; personal data redacted before any external model; customer-supplied keys; closed action menu; kill switch |
Scope and Current Coverage
Frequently Asked Questions
Is PrimeOps suitable for managed service providers with many customers?
Yes. Each customer has its own schema and identity realm, and provider staff work from a separate console and cross-tenant NOC view under logged entitlements.
Which deployment options are available?
PrimeOps is designed to run as a managed service, in the customer's own cloud account, or on premises.
Can AI agents change production systems without approval?
Only low-risk actions by an agent cleared for autonomy proceed without approval, and only when the autonomy setting for that agent and customer allows it. Other actions require one or two approvers. Containment of security alerts always requires approval.
Is AI mandatory?
No. AI functions are off by default and are enabled per customer. External language models are optional, use customer-supplied keys and receive redacted prompts.
Is PrimeOps aligned with ITIL?
PrimeOps is aligned with ITIL v4 practices, including incident, problem, change, request and knowledge management.
Does PrimeOps hold SOC 2 or ISO 27001 certification?
Not at present. Both certifications are planned, following an independent penetration test.
Request a PrimeOps Demonstration
Aevum Digital can demonstrate PrimeOps against a simulated multi-customer estate, covering alert correlation, approvals and verified remediation.
References
- Gartner, press release on task-specific AI agents in enterprise applications, August 2025. Source.
- Atlassian, Data Center migration information. Source.
- Linklaters, India's cyber security framework and breach reporting obligations (CERT-In Directions), 2022. Source.
- Reserve Bank of India, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023. Source.
ITIL is a registered trademark of PeopleCert. Other product names are trademarks of their respective owners. Regulatory information on this page was last reviewed on 1 November 2026 and is provided for general information.