Never Start From Zero: Building Salty, a Team-Memory Agent for Platform Investigations

By Anas Semesmieh · November 14, 2026

Copilot made every engineer on my team faster. It did nothing about the fact that we kept solving the same problem for the first time. Platform knowledge lived in people's heads and in Slack threads nobody could find again. Every investigation started from zero.

That is the problem Salty is built for. Salty is a workspace agent with the team's memory bolted on. I built it from scratch, proved it myself, then handed it to the team. This is how it works, what it changed, and what I would do differently.

1. Why every investigation started from zero

An incident on our platform means correlating context across six places: Azure, GitHub, Cloudflare, Dynatrace, Splunk and Jira. Each one has its own console, its own query language and its own history. Whatever the engineer on call worked out on Tuesday was not available to whoever was on call on Friday.

The write-up suffered most. Post-incident reviews were written days later, in whatever shape the author felt like, scattered across tickets and documents. Writing them was a burden, so they were late, thin, or quietly skipped.

2. The design: four parts

Every area in the vault has two reading levels: a detailed note and a summarised one. On-call reads the summary. The investigation reads the detail. The vault also holds a generated Azure as-built report of the whole estate, so the agent starts from what is actually deployed.

3. The rules that make it safe to trust

• Read-only by default. Every call is a list, show or get. Anything that changes state needs explicit confirmation, with the blast radius stated first.
• No secrets, ever. The vault records where a credential lives, never its value.
• A human approves what becomes memory. The agent drafts, a person reviews, then it is promoted.
• The prime directive: never start from zero. Read the memory before acting. Write back what you learned after.

4. How it rolled out

I started in August 2026 on my own laptop. Once it had proved itself, I gave it to a group of four champions, me included, in September. In October it went to the whole platform team. For now it is for the platform team only.

The part that compounds is that the team writes the skills, prompts and scripts, and they are reviewed and shared. When one engineer works out how to interrogate Cloudflare properly, that becomes a capability everyone has, permanently. A shared brain beats a lot of private ones.

5. What changed

Platform investigations are about 60% faster to resolve. That is an internal estimate across the team and not an instrumented benchmark, so read it as direction, not precision. The second change matters as much to me: the write-up is no longer optional. Post-incident reviews are drafted by the agent in a standard shape, reviewed by me, linked to the problem ticket and filed where the next person will find them. That means the learning actually lands in the memory the next investigation reads.

6. What I would do differently

1. Use a real memory system, not Markdown files. A Markdown vault is easy to start with and easy for people to read and review. It does not scale gracefully. Search, relevance, expiry and "which note is stale" all want a proper memory layer under them.
2. Give Salty capabilities to remediate, but only after human approval and a risk assessment. Today it investigates and drafts. The next step is proposing a fix, stating the risk and blast radius, and acting only when a person signs off.

7. Build your own: where I would start

1. Pick one recurring investigation that always starts from zero, and write the first notes by hand.
2. Give the agent read-only access to the two or three systems that investigation touches. Nothing else.
3. Make "draft, then a human promotes" the only path into the memory.
4. Write the no-secrets rule down on day one: record where a credential lives, never the value.
5. Prove it on yourself first, then give it to two or three champions, then the team.
6. Make the post-incident review the first workflow you automate. It is the cheapest proof that the memory is working.

Closing thought

Copilot raises each engineer's speed. A shared memory raises the team's. If you are deciding where the next AI hour goes, I would put it into the compounding layer first. I wrote about the leadership side of that bet in AI or Die.