AI agents don't solve IT operations' main problem

A new stage in this conversation

Throughout the Modern IT Operations series, we explored how the growing complexity of technology environments changed the nature of the challenges operations teams face. We discussed why so many organizations keep firefighting, how the advance of observability was accompanied by an ever-growing volume of alerts, why detecting an incident is usually relatively simple, but building the context needed to identify its root cause remains one of the hardest tasks in operations, how observability represents a new way of operating, and why reducing MTTR depends far more on how fast we understand an incident than on how fast we execute its recovery.

If the first five articles sought to understand how modern operations evolved to reach today’s challenges, this new series starts from a different question.

How will Artificial Intelligence transform the way IT operations are structured in the coming years?

It is a particularly relevant discussion because, in recent months, it has become practically impossible to attend a technology event, open a specialized publication, or talk to vendors without running into a new promise related to Artificial Intelligence agents.

We are asking the wrong question

Every week, new solutions appear that can analyze logs, interpret metrics, run playbooks, open tickets automatically, investigate failures in Kubernetes environments, manage cloud resources, or assist development and operations teams. The speed at which these solutions evolve is impressive and, in many cases, justifies the enthusiasm the market has shown.

The discussion is no longer whether companies will use agents. The question became how many agents each organization should have and which activities can be delegated to them.

Everything indicates that this transformation will really happen, but perhaps we are starting the conversation with the wrong question.

Throughout the first series of articles, we saw that the main challenge of modern operations was never the absence of tools capable of executing tasks. Nor was it a lack of monitoring, observability, or specialists.

The real challenge has always been the ability to quickly understand what is happening in environments that are increasingly distributed, heterogeneous, and interdependent.

That distinction seems subtle, but it completely changes how we should analyze the current wave of Artificial Intelligence agents.

If we believe the biggest problem in operations is executing repetitive activities, then it makes sense to imagine that specialized agents will, by themselves, be the next big evolution of the field. After all, they will be able to automate investigations, interpret technical information, and even execute corrective actions much faster than we do today.

But is that really the main problem?

An incident rarely respects tool boundaries

Imagine an operation that uses different platforms to manage its technology environment.

Infrastructure monitoring is done by one tool. Application observability uses another. Logs are centralized on a third platform. IT service management happens in an ITSM system. The cloud provides its own monitoring mechanisms. Network equipment, databases, security solutions, and critical applications also continuously produce events, metrics, and alerts.

Now imagine each of these platforms comes with its own Artificial Intelligence agent.

Individually, this scenario looks extremely promising.

The observability agent can interpret application traces and metrics. The agent responsible for monitoring quickly identifies availability changes. Another agent analyzes logs looking for abnormal patterns. A fourth tracks recent infrastructure changes. The ITSM uses an agent that can correlate similar tickets and suggest handling procedures.

Each of these agents can be highly competent within the domain it knows.

The problem is that real incidents rarely stay confined to a single domain.

A configuration change made on an authentication service can increase latency on certain APIs. That degradation creates queues in another component, which starts consuming more compute resources, producing new infrastructure alerts, affecting the user experience, and increasing the volume of tickets logged by the Service Desk.

None of these events is false, and all of them are legitimate manifestations of the same incident. However, each agent will keep observing only the portion of reality accessible to the platform it lives on.

This is precisely where a much more important question arises than simply knowing how many agents an organization should have.

The problem is not the agents’ intelligence

The question we ended the previous section with may be the most important one in this article.

Who will be responsible for connecting all these views?

This question tends to go unnoticed because, when we watch demos of Artificial Intelligence agents, we usually see only one specific domain. We see one agent analyzing logs, another interpreting metrics, another suggesting actions for an observability platform or automating activities inside an ITSM tool. In all these scenarios, the results are usually impressive.

There is no doubt that these solutions represent an important advance.

It would be a mistake to underestimate their ability to increase team productivity and automate tasks that until recently depended exclusively on human intervention.

The central point, however, is not that. The real challenge begins when we stop looking at each tool in isolation and start analyzing the behavior of the operation as a whole. Relevant incidents almost never stay confined to a single platform.

In a large financial institution, for example, a simple change to an authentication service can affect mobile applications, APIs used by partners, internal systems, security mechanisms, processing queues, and distributed databases. Each platform will record only the symptoms it can observe. For the agent responsible for logs, the problem will look like a specific set of error messages. For the infrastructure agent, it will be an increase in resource consumption. For the observability agent, a performance degradation. For the ITSM, a sudden growth in the number of tickets.

None of them will be wrong, but none of them will individually have enough information to understand the incident in its full extent.

This behavior does not stem from a limitation of Artificial Intelligence; it stems from the very architecture of modern operations.

Each tool was built to observe a specific domain of technology. Naturally, the agents built on these platforms inherit that same perspective. The more specialized they become, the greater their ability to interpret data from that domain tends to be. In contrast, the lower their ability to understand events that go beyond the limits of the tool itself.

This characteristic deserves attention because the market has concentrated a good part of its investments precisely on developing these digital specialists.

We are watching the emergence of agents for cloud, networks, databases, observability, security, development, support, infrastructure, and practically every discipline of IT operations.

It is an extremely positive evolution, but it does not eliminate a fundamental question.

How will all these specialists share the same understanding of the incident?

The next barrier created by the complexity of operations

This may be the next major transformation IT operations will go through.

For many years, the challenge was to integrate monitoring, observability, automation, and ITSM tools. Now we are starting to move toward a scenario in which it will also be necessary to integrate intelligences.

Each agent will produce analyses, hypotheses, recommendations, and decisions based on the information it has access to. The greater the number of specialized agents, the greater also the need to ensure they all work on the same operational reality.

Otherwise, we risk reproducing, on an even larger scale, a problem we already know very well.

Today, different teams analyze different tools and often reach different interpretations of the same incident.

Tomorrow, we may have different agents analyzing different platforms and reaching exactly the same kind of divergence.

In other words, Artificial Intelligence can significantly increase our ability to analyze information. But that does not automatically mean it will increase our ability to build a single understanding of what is really happening.

That difference matters because it completely changes the focus of the discussion.

Perhaps the biggest challenge of the next generation of operations is not developing ever more intelligent agents.

Perhaps it is creating a way to give all of them the same operational context, so their analyses stop being merely correct within a specific domain and start making sense within the complete behavior of the operation.

This change of perspective leads us, naturally, to the question that closes this second part.

What if the real strategic asset of modern operations is not the agents, but the shared context they work on?

Context is the starting point, not the result

There is a natural tendency when we talk about Artificial Intelligence applied to IT operations.

We imagine that, as agents evolve, they will understand incidents better. After all, if they can interpret logs, correlate events within a platform, and suggest corrective actions, it seems reasonable to conclude that, with ever more sophisticated models, this understanding will become practically unlimited.

That conclusion, however, rests on a premise worth questioning: no agent can reason about information it does not have access to.

This limitation is not related to the quality of the language model or the number of parameters used in its training. It is an inherent characteristic of any Artificial Intelligence system: its ability to analyze depends directly on the context available at the moment it has to make a decision.

Think of a specialist physician who receives only a blood test result.

Even as an excellent professional, they are unlikely to issue a definitive diagnosis without knowing the patient’s history, the symptoms presented, the medications used, previous exams, and other elements that make it possible to understand the clinical picture as a whole.

In IT operations, exactly the same thing happens.

One agent can perfectly interpret the events recorded by an observability platform. Another can understand in detail an application’s logs. A third can analyze recent infrastructure changes or identify anomalous behavior in cloud services.

Each will produce consistent analyses, each will formulate coherent hypotheses, and each may recommend technically correct actions. But all of them will remain limited by the context they received.

That is precisely why the discussion about agents cannot be separated from the discussion about operational context.

The more distributed technology environments become, the greater the difference between having information and having understanding.

An organization can have dozens of extremely competent agents, each analyzing thousands of events per second, and still spend long minutes trying to answer the same question that has accompanied operations for decades:

What is really happening?

The answer will hardly be in a single tool, and it will not be in a single agent either.

It will be in the ability to bring together information from different platforms, understand the dependency relationships among applications, infrastructure, networks, cloud services, and business processes, and reconstruct the sequence of events that led to the incident.

This may be the main misconception in the current discussion about Artificial Intelligence applied to operations.

We are putting much of our attention into making each agent more intelligent, but perhaps we should give the same attention to the environment in which these agents will work. Because intelligent agents operating on fragmented information will keep producing fragmented interpretations.

A new layer in the architecture of operations

This change of perspective leads to an interesting consequence.

For many years, organizations structured their operations on different technology layers. Monitoring watched availability. Observability expanded investigative capability. ITSM organized processes. Automation tools executed operational procedures.

Artificial Intelligence agents tend to occupy a new layer of this architecture.

They will interpret information, recommend actions, automate activities, and support decisions in an increasingly sophisticated way.

But there is a prior layer that is starting to gain strategic importance: the layer responsible for building shared operational context.

It is there that information from monitoring, observability, logs, events, topology, service dependencies, recent changes, CMDB, cloud platforms, and business indicators comes together to form a single view of the environment.

Only when this context exists can specialized agents stop acting as excellent isolated specialists and start collaborating on a single understanding of the incident.

This may be the main architectural change we will see in the coming years.

The discussion will stop being only how many agents an organization has, and will become how all these agents share the same view of the operation.

And that question naturally prepares the reflection that will close this article.

If agents represent a new layer of operational intelligence, what will be the role of the platforms responsible for building and maintaining this shared context?

The next step for IT operations

Whenever a new technology appears, there is a natural tendency to imagine that it will, on its own, solve the main challenges of the previous generation.

That was the case with monitoring, then observability, and more recently automation.

Now we are living through the same movement around Artificial Intelligence agents.

All these advances undoubtedly represent an important evolution of IT operations.

However, over the last five articles in this series, we saw that the biggest challenges of modern operations were never just about the ability to collect information, automate tasks, or execute procedures faster.

They have always been related to the ability to understand increasingly complex environments.

That finding remains valid in the Artificial Intelligence era.

Specialized agents will be able to interpret information, recommend actions, and automate processes with ever greater efficiency. They will probably transform deeply how we operate technology environments.

But there is a question that will remain regardless of the number of agents in the organization.

Will they all be working on the same understanding of the incident?

If the answer is no, we risk reproducing a problem we already know very well.

Today, different specialists analyze different tools and need to collectively build an explanation of what is happening.

Tomorrow, we may have extremely intelligent agents analyzing different platforms and facing exactly the same challenge.

That leads us to a conclusion that is, perhaps, more important than the discussion about agents itself.

The real competitive differentiator of modern operations will probably not be the number of Artificial Intelligences available, but the quality of the shared operational context that allows all of them to interpret the same reality.

Perhaps this is the next big evolution of IT operations.

Not an evolution based only on agents.

But an evolution based on the ability to build an integrated view of the environment, capable of connecting information from multiple sources, revealing dependency relationships among services, and offering a common understanding of what is really happening.

When that happens, people and Artificial Intelligences stop competing over the interpretation of data and start collaborating on a single knowledge base.

It is precisely this change of perspective that, in my opinion, will define the next generation of IT operations.

In the next article, we will go deeper into exactly this idea by discussing why, before developing ever more sophisticated agents, organizations will need to build what may be their most important asset: shared operational context.

Food for thought

The discussion about Artificial Intelligence in IT operations should not start by asking how many agents an organization intends to use.

Perhaps the most important question is another.

How will these agents build a common understanding of an incident that crosses dozens of different platforms?

Because specialized agents can interpret a tool very well.

But only shared operational context makes it possible to understand the whole operation.

About the author

Paulo Florêncio de Menezes is an entrepreneur, partner, and co-founder of companies such as Target Solutions, BiPTT, and ARGUS.

He holds a degree in Data Processing from the Federal University of Amazonas (UFAM), an MBA in Business Management from Fundação Dom Cabral (FDC), and a Professional Master’s in Economics from Fundação Getulio Vargas (FGV).

In his Master’s research, he developed the IBEOP-IA (Brazilian Index of Potential Occupational Exposure to Artificial Intelligence), investigating the potential exposure of Brazilian occupations to AI capabilities by combining occupational data, artificial intelligence patents, and natural language processing techniques.