> ## Documentation Index
> Fetch the complete documentation index at: https://docs.changeguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Your first 30 minutes

> From an installed collector to real value: see what changed, run a pre-flight check, and read an incident with cited evidence.

You've [installed](/get-started/install) ChangeGuard. This guide takes you from "it's installed" to "I've seen what it does" — in about half an hour, on your own cluster, with a sample incident you can trigger safely and clean up completely.

<Note>
  Everything here is **advisory and read-only**. Nothing in this guide changes your workloads (the sample incident happens in a scratch namespace you create and delete). ChangeGuard does not act on your cluster until you explicitly opt into [remediation](/autonomy/autonomy-model).
</Note>

## Minute 0–5 — Verify the install

Three checks and you know everything is healthy:

```bash theme={null}
kubectl rollout status deploy/changeguard-operator -n changeguard-system --timeout=60s
kubectl rollout status deploy/changeguard-collector -n changeguard-agent --timeout=60s
```

<Check>
  Both roll out successfully, and in [app.changeguard.ai](https://app.changeguard.ai) your cluster appears in **Fleet** with the connection indicators green ("Agent connected", "Workloads detected").
</Check>

If any check fails, the [install guide's troubleshooting table](/get-started/install#if-a-step-didnt-produce-the-result-shown) has the fix — it's almost always egress or the API key.

## Minute 5–10 — Read your score, run a pre-flight — and meet the Advisor

<Steps>
  <Step title="Open Safe to Ship?">
    Your cluster already has a **CSC Score** — a deterministic 0–100 read of deploy readiness. Every point ties to a concrete signal you can inspect.
  </Step>

  <Step title="Run a pre-flight check">
    You get **SHIP / HOLD / BLOCK** with the score and reasons. It's advisory — a recommendation, never an enforced block.
  </Step>

  <Step title="Look for the Advisor's read">
    Where the **Engineering Advisor** is enabled <Tooltip tip="Early Access — available to design partners and on request">Early Access</Tooltip>, its note appears with the verdict: the read a senior engineer would give, led by what's true in your cluster right now, honest about what it can't see.
  </Step>
</Steps>

<Info>
  **Two things that are correct, not broken:** if the Advisor has nothing material to add, it stays **silent** — restraint is the feature. And if you don't see the Advisor at all, that's expected — it's Early Access; [contact us](mailto:support@changeguard.ai) to join.
</Info>

## Minute 10–15 — See your first change

Deploy something, tweak a config, or let a GitOps sync flow in — ChangeGuard is already recording every deployment, config, and GitOps change across the fleet.

<Check>
  The change appears in ChangeGuard with **what actually changed** — the commit and diff, not just "a deploy happened."
</Check>

## Minute 15–25 — Trigger a sample incident, safely

Now the part worth the price of admission: watch a failure get correlated to the change that caused it. Do this in a scratch namespace so it touches nothing real:

```bash theme={null}
# 1. A healthy sample service
kubectl create namespace cg-sample
kubectl -n cg-sample create deployment sample-api --image=nginx:1.27-alpine --replicas=2
kubectl -n cg-sample rollout status deployment/sample-api --timeout=120s

# 2. Ship a bad change — a typo'd image tag, the classic bad deploy
kubectl -n cg-sample set image deployment/sample-api nginx=nginx:1.27-alpine-nonexistent
```

The new pods can't pull the image, the rollout starts failing, and ChangeGuard sees both the change and the failure.

<Check>
  Within a few minutes, an incident appears for `sample-api` — **linked to the image change you just made**. Cause, not just symptom.
</Check>

Then ship the fix and watch recovery:

```bash theme={null}
# 3. Revert — the "rollback" a real team would do
kubectl -n cg-sample set image deployment/sample-api nginx=nginx:1.27-alpine

# 4. When you're done exploring, remove every trace
kubectl delete namespace cg-sample
```

## Minute 25–30 — Open the investigation: understanding, evidence, opinion

Open the incident before you clean up.

<Steps>
  <Step title="Read the Current Understanding">
    Where incident context is enabled, the incident opens with the **Current Understanding** — the shared, maintained read of what's happening right now: what changed, what it broke, and where things stand. What a teammate joining mid-incident needs, without scrolling the history.
  </Step>

  <Step title="Check the evidence">
    The root cause comes with **cited evidence** — the events, the failing rollout, and the change that shipped it. Claims trace to records, not vibes.
  </Step>

  <Step title="Read the proposed fix — and how to verify it">
    ChangeGuard proposes the fix and states the verify criteria. It applies nothing at the default autonomy level — this is advice you act on.
  </Step>

  <Step title="Look for the Opinion">
    Where the **Engineering Opinion** is enabled (Early Access), you'll also see ChangeGuard's owned position: belief, confidence, tradeoffs, and what would change its mind.
  </Step>
</Steps>

<Check>
  Every incident also carries an append-only **activity timeline** — your audit trail of what was observed and decided.
</Check>

## Set your comfort level

ChangeGuard's autonomy is a dial, not a switch: **Observe → Advise → Approve → Auto**, default **Advise**.

| Level                  | What ChangeGuard does                                                              |
| ---------------------- | ---------------------------------------------------------------------------------- |
| **Observe**            | Watches and records only.                                                          |
| **Advise** *(default)* | Recommends actions; a human does everything.                                       |
| **Approve**            | Prepares an action and waits for a human to authorize it.                          |
| **Auto**               | Executes within policy, then verifies — and rolls back once if verification fails. |

<Warning>
  `Approve` and `Auto` only do anything after you opt into [Autonomous Remediation](/autonomy/autonomy-model) and grant its RBAC. Until then, ChangeGuard stays at advice.
</Warning>

## You've now seen the loop

In 30 minutes: a verified install, a scored cluster, a pre-flight verdict, a real change with its diff, a failure correlated to its cause, an evidence-cited investigation — and, where enabled, the Understanding, Opinion, and Advisor that turn it into a teammate.

<CardGroup cols={2}>
  <Card title="Understand the concepts" icon="book" href="/concepts/overview">
    What CSC Score, Change Intelligence, and the autonomy model really mean.
  </Card>

  <Card title="Operate it day-to-day" icon="gear" href="/operations/overview">
    Health checks, upgrades, notifications, and keeping the collector happy.
  </Card>

  <Card title="Wire in your tools" icon="plug" href="/integrations/overview">
    GitOps, CI gates, and notifications — what each reads, writes, and needs.
  </Card>

  <Card title="Review permissions" icon="shield" href="/get-started/permissions">
    Exactly what ChangeGuard can and cannot see or do in your cluster.
  </Card>
</CardGroup>