ENTHOW IT WORKS, IN PLAIN TERMS

From Searching
Six Tools
to One
Case File.

Entalinity is an AI operations layer that does the work the way a good engineering team does. Overlay does the tier 1 work. Inlay does the tier 2 and above work. Both sit on a data layer that connects the tools you already run, and both feed an intelligence store that remembers what worked.

BN

Bheki Ntando Ngwenya

FOUNDER · ENTALINITY · SANDTON

Apply for the PilotContact Bheki

DRAG TO ORBIT THE FOUR LAYERS

Dozens

Alarms per fault

One core link, every customer behind it

1

Case file

Every version, every piece of evidence

T1

Overlay

Tier 1 authority. Raises requests.

T2+

Inlay

Authority you set, scaled by risk

0

Tools replaced

Your systems stay the record

01
IF YOU READ ONE SECTION

The Search.
Before the Work.
Every Single Time.

Telecom operators run on dozens of disconnected tools: monitoring, ticketing, inventory, customer systems. When something breaks, people spend most of their time searching those tools, reconciling records that disagree and assembling evidence before any technical work begins.

A single fault can trigger dozens of alarms. A core link goes down, every customer link behind it alarms, and sometimes a second core link that depends on the first goes down too. Someone has to find the affected customers by hand, attach the evidence, log the ticket and keep customers informed.

Rule-based automation helps only while the data is clean and every system follows the expected format. Real operations data drifts constantly, and when it does, rules fail silently.

WHAT WE ARE BETTING ON

Give the tier 1 work to a system that connects every tool, correlates in moments and never pretends a conflict away. Then let your engineers do the work only they can do.

WHERE THE EFFORT GOESDRAG TO ORBIT
Network infrastructure

MORE TOOLS HAVE NOT FIXED IT

AT A GLANCE

Built forTelecom operators first. Any team running many tools.
Failure patternDozens of alarms from one fault
Root causeDisconnected tools + drifting data
Where time goesSearching, reconciling, logging
Entalinity answerOverlay + Inlay on one data layer
02
WHERE IT BREAKS TODAY

Why Incidents
Take So Long.
Three Hard Truths.

From years of tier 1 work inside a network operations centre: three things that make every incident slower than it needs to be, no matter how many tools the team already has.

A
TIME TO A CASE FILEDRAG TO ORBIT
HARD TRUTH A

The Search Before the Work

When a fault lands, the first job is not fixing it. It is finding out what it touches: which customers sit behind the failed link, which tickets already exist, what the monitoring saw and when it started.

That work is done by hand, across several tools, while customers wait and the SLA clock runs. It is slow, repetitive and error-prone, and it happens on every single incident.

TIME SPENT

Searching

CUSTOMERS

Waiting

HARD TRUTH B

Records That Disagree

Every tool keeps its own copy of the truth. Monitoring, inventory and ticketing each describe the same circuit, the same customer and the same link in their own format, with their own IDs, and they drift apart over time.

So one fault becomes a cascade of similar-looking alarms and duplicate tickets, and the root cause is buried under them. Someone has to decide which record is right, usually in the middle of the incident.

OBSERVED PATTERN

Monitoring shows one circuit. Inventory shows another. Two monitoring tools each hold their own version. The ticket gets logged against whichever one the engineer found first.

ONE FAULT, MANY RECORDSDRAG TO ORBIT
B
C
RULES VS REAL DATADRAG TO ORBIT
HARD TRUTH C

Rules That Fail Silently

Rule-based automation is cheaper and more predictable where data is clean, and we use ordinary code there too. But rules only work while every system follows the expected format.

When one record drifts, rules usually fail without a sound: they stop matching, or they map a customer to the wrong link, and nothing flags it. Inconsistent alarm formats, free-text ticket notes and undocumented dependencies are exactly where rules break, and where AI earns its place.

03
HOW IT WORKS

The Entalinity
Platform.
Four Layers. Two Products.

You buy Overlay, Inlay, or both. Each one does the work of a human role and holds that role's authority, no more. Authority widens only as trust is earned.

Both run on the data layer, which connects to your existing tools without replacing them, and both feed the intelligence store, which keeps what the system learns. You own it.

Every Tool Connected. Every Record Linked.
THE DATA LAYER · CONNECTS YOUR TOOLS

QUICK SPEC

ConnectsMonitoring · ticketing · inventory · customer systems
DoesNormalise · link · mirror · audit
YOUR TOOLS, CONNECTEDDRAG TO ORBIT
LAYER 1

Every Tool Connected. Every Record Linked.

The data layer connects to the tools you already run (monitoring, ticketing, inventory, customer systems), converts their formats into one consistent shape, and links records that refer to the same thing: a customer link to its core link, an inventory ID to a monitoring ID.

It keeps a synced mirror, a history of what was seen and when, and an audit trail. It takes no actions, and your own systems remain the owners of the data. Connectors, ID normalisation, linking and sync are ordinary, deterministic software. Where rules work, we use rules.

OUTCOME

Everything above it reasons over one connected picture instead of six disconnected ones.

CONNECTS

Monitoring · ticketing · inventory · customer systems

DOES

Normalise · link · mirror · audit

ACTIONS

None. Read and sync only.

OWNER OF RECORD

Your systems, always

The Tier 1 Work, Done Before Anyone Starts Searching.
OVERLAY · THE TIER 1 ENGINEER

QUICK SPEC

AuthorityTier 1. Raises requests, never makes changes.
HandlesCorrelation · evidence · tickets · customer updates
ONE INCIDENT, END TO ENDDRAG TO ORBIT
LAYER 2

The Tier 1 Work, Done Before Anyone Starts Searching.

Overlay does the work of a tier 1 NOC engineer. It investigates alarms, correlates them to a single root cause, gathers evidence, checks external factors such as weather, identifies which customers are affected, logs and updates tickets, and keeps customers informed. If your monitoring already logged the fault, Overlay enriches that ticket instead of creating a duplicate.

When records conflict, it does not pick a winner. It attaches every version, escalates to tier 2 with the evidence, and holds detailed customer updates until the facts are confirmed, sending only a holding message that carries no uncertain facts. Like a human tier 1, it does not change the network or your systems of record. It raises requests instead.

OUTCOME

Your engineers start every incident with a complete case file instead of a blank screen.

AUTHORITY

Tier 1. Raises requests, never makes changes.

HANDLES

Correlation · evidence · tickets · customer updates

ON CONFLICT

Attaches every version and escalates

MODELS

Open-source models for routine work

Deeper Analysis. Fixes Within the Authority You Set.
INLAY · TIER 2 AND ABOVE

QUICK SPEC

AuthoritySet by you, scaled by risk and impact
HandlesAnalysis · proposed fixes · record corrections
PROPOSE, CHECK, THEN ACTDRAG TO ORBIT
LAYER 3

Deeper Analysis. Fixes Within the Authority You Set.

Inlay takes escalations with a complete case file. It performs the deeper technical analysis, proposes fixes, corrects systems of record such as inventory, and makes network changes only where you have authorised it.

Its permissions depend on two things: the risk of the action and the impact on the customer. An inventory correction is low risk, a service restart medium, a core configuration change high. You set the thresholds. Low-risk actions on non-critical customers can run automatically with a log. Higher-risk actions need one-tap approval, and the highest need a named senior engineer and a rollback plan. Data corrections wait for evidence and pass through an approval queue.

OUTCOME

Advanced reasoning on the cases that need it, and never more authority than you have granted.

AUTHORITY

Set by you, scaled by risk and impact

HANDLES

Analysis · proposed fixes · record corrections

APPROVAL

Automatic · one-tap · senior engineer + rollback

MODELS

Frontier models for advanced reasoning

Every Outcome Remembered. Every Lesson Reversible.
THE INTELLIGENCE STORE · WHAT IT LEARNS

QUICK SPEC

LearnsTool reliability · cascades · approved fixes
SourceReviewed outcomes only
OUTCOMES, RECORDEDDRAG TO ORBIT
LAYER 4

Every Outcome Remembered. Every Lesson Reversible.

The intelligence store records what the system learns: which tool is reliable for which field, how your network's failures tend to cascade, which proposals your engineers approved or rejected, and which fixes actually worked.

Learning comes only from reviewed outcomes. It is versioned, and you can inspect it and roll it back. It is what makes the system better at your environment over time, and because it is built from your incidents, it belongs to you.

OUTCOME

The longer it runs, the better it knows how your network actually behaves.

LEARNS

Tool reliability · cascades · approved fixes

SOURCE

Reviewed outcomes only

CONTROL

Versioned · inspectable · rollback

OWNER

You

04
WHAT CHANGES FOR YOU

Built for Operations
Teams.
And Their Customers.

For telecom operators first, and for any team that runs on many tools, Entalinity changes what an incident looks like from the first alarm to the last customer update.

US AGAINST THE ALTERNATIVESDRAG TO ORBIT

The chart compares Entalinity with a manual NOC and with rule-based automation across six things operations teams care about. It shows the shape of the difference, not a benchmark. The pilot measures the real numbers on your incidents.

TIME TO CASE FILE

Entalinity: Built as the alarms land

Today: Assembled by hand across tools

MESSY DATA

Entalinity: Conflicts surfaced, never guessed

Today: Rules stop matching silently

CONTROL

Entalinity: Authority you set, every action logged

Today: All or nothing

CAPABILITY
MANUAL NOC
RULE-BASED AUTOMATION
ENTALINITY
Affected customers
Found by hand across tools
Works while IDs match
Linked automatically by the data layer
Conflicting records
Settled mid-incident, from memory
Fails silently or maps wrongly
Every version attached and escalated
Duplicate tickets
Common during cascades
Depends on exact rules
Existing ticket enriched, not duplicated
Customer updates
Late, when someone has time
Templated, often wrong
Holding message first, full update once confirmed
Messy, drifting data
Handled by experience
Breaks quietly
AI used exactly where rules break
Network changes
Engineer, by hand
Scripted, if someone wrote it
Only within the authority you set
Audit trail
Ticket notes
System logs
Every action, who approved it and why
Your existing tools
Stay
Stay
Stay. Nothing ripped out.
What is learned
Leaves when people leave
Rules maintained by hand
Intelligence store, versioned and yours
A. Engineers Stop Searching

A. Engineers Stop Searching

Every incident arrives with the root cause, the evidence, the affected customers and every conflicting record already attached. Your engineers spend their shift fixing faults, not hunting for them across six tools.

B. Customers Hear First

B. Customers Hear First

Affected customers get a holding message straight away, with nothing uncertain in it, and a full update once the facts are confirmed. Fewer customers phoning in to tell you something is down.

C. Authority That Grows With Trust

C. Authority That Grows With Trust

You would not hand an AI free rein over a live network, and you should not. Each product holds the authority of the human role it supports, and widens only as trust is earned. Every action is logged with who or what approved it, and why.

D. The Right Model for Each Job

D. The Right Model for Each Job

A hybrid approach. Open-source models handle routine tier 1 work. Frontier models from labs such as Anthropic (Claude) and OpenAI (ChatGPT) handle advanced reasoning and tier 2 escalations. We choose and manage the models, and can run them in-country or on-premise where required.

E. Telecoms First. Not Telecoms Only.

E. Telecoms First. Not Telecoms Only.

We start with telecom operators because that is where we know the work best. But the problem is general: any operations team running on many disconnected tools (ISPs, data centres, IT service desks, utilities) searches, reconciles and logs the same way.

05
THE PILOT

One Operator.
Measured Results.

We are looking for one operator for a focused pilot: one incident type (for example backhaul or core link failures and their downstream customer impact), with Overlay only.

Overlay gets read access plus tier 1 ticket and customer-update authority. No network changes in the first phase. Targets are agreed with you before we start.

01

Agree Targets, Connect Read-Only

We agree what success looks like, then connect the data layer to the tools behind the chosen incident type. Read access only.

02

Overlay Live

Overlay works your real incidents with tier 1 authority: case files, tickets and customer updates. Conflicts are escalated, never guessed.

03

Measure and Decide

Time from alarm to case file, duplicate tickets avoided, conflicts confirmed, customer-identification accuracy, time to first update and cost per incident. Then you decide.

HOW THE PILOT RUNSDRAG TO ORBIT
Infrastructure deployment

YOUR REAL INCIDENTS · NOT SYNTHETIC DATA

PILOT SCOPE

One incident type. Overlay only. Read access plus tier 1 authority.

PARTNERS

1

One operator at a time.

WHO THIS SUITS

→

A telecom operator, ISP or fibre network with a busy NOC

→

Monitoring, ticketing, inventory and customer records kept in separate tools

→

Incidents slowed by searching, conflicting records and duplicate tickets

→

Leadership willing to measure results against agreed targets