Production database incidents in healthcare environments require fast diagnosis, strict confidentiality, and evidence-bound communication. Large language models can help summarize investigation findings, but their use is risky when prompts contain sensitive operational details or when AI-generated conclusions overstate what the evidence proves. This preprint proposes and evaluates an evidence-grounded AI-assisted SQL Server incident investigation framework that combines time-bound input validation, read-only diagnostic execution, compact evidence packing, strict DBA prompt constraints, deterministic quality gates, and safe fallback reporting. The framework was evaluated using an anonymized production-style incident investigation case in which a database-wide 30-minute review window contained three incident timestamps. The tool executed 29 read-only diagnostics with 29 successes and zero failures; verified Query Store historical coverage with three intervals and 9,212 runtime rows in the reviewed window; captured database-wide top-consumer duration evidence with a highest max duration of 3,599,654.429 ms; identified two deadlock rows; showed zero current blocking rows at execution time; captured 36 overlapping SQL Agent job rows; and classified zero SQL error-log messages. A compact AI evidence pack reduced the full diagnostic output to a privacy-aware summary, and the AI result was rejected by the strict DBA QA gate and replaced by a deterministic safe fallback report. The contribution is a practical governance pattern for using AI in production DBA investigations: AI may assist with interpretation, but final communication must remain scoped to captured evidence, avoid unsupported health claims, and preserve sensitive operational context. This manuscript intentionally excludes organization names, server hostnames, IP addresses, usernames, database names, raw SQL text, internal object identifiers, staff/patient names, MRNs, phone numbers, and protected health information. Metrics are retained only as anonymized, aggregate operational evidence.
Mohamed Ezzat Shady (Sun,) studied this question.