# Workflow — Alert Noise Reduction Agent

## 1. 1. Ingest the stream

Pull the alert inventory and metadata over the analysis window.

## 2. 2. Score actionability

For each alert, compute ack rate, time-to-ack, and fire volume, and pull incident correlations.

## 3. 3. Correlate & dedupe

Group related/duplicate alerts so one root cause isn't ten pages, keeping the underlying alerts visible.

## 4. 4. Identify noise candidates

Flag chronically non-actionable, never-incident-linked, non-critical alerts — and nothing else.

## 5. 5. Apply the gate

Forbid suppressing any incident-linked or critical-service alert; those get tuning recommendations or escalation instead.

## 6. 6. Tune or suppress

Open tuning PRs and apply bounded, reversible, time-boxed suppression only where the evidence and guardrails allow.

## 7. 7. Audit & review

Log every action with evidence and expiry, and surface a review so on-call sees exactly what was quieted.
