Knowing the tool is not understanding the incident

When specialization is no longer enough

Throughout the first series of articles, we discussed how IT operations became progressively more complex as applications, services, cloud platforms, and infrastructure began to work as highly distributed and interdependent ecosystems. This transformation led us to conclude that quickly understanding an incident depends far more on the ability to build context than on the mere availability of monitoring or observability tools.

In the first two articles of this second series, we expanded this discussion to the universe of Artificial Intelligence. First, we questioned the idea that specialized agents, on their own, will solve the main challenges of modern operations in the article “AI agents do not solve the main problem of IT operations”. Then, we showed that any agent depends on an element that comes before Artificial Intelligence itself: a shared operational context, able to gather and organize information from multiple sources, in “Before agents, there is operational context”.

These two reflections naturally lead to a new question.

If operational context is so important, why couldn’t a specialized agent build it on its own?

The answer involves a characteristic that, paradoxically, represents at the same time the greatest strength and the main limitation of these agents.

They were designed to be specialists.

The strength of specialization

Whenever we watch demonstrations of Artificial Intelligence agents, it is natural to be impressed by their ability to perform highly specific tasks. Some analyze thousands of lines of logs in seconds. Others identify anomalous behavior in observability platforms, interpret infrastructure metrics, suggest recovery procedures, query knowledge bases, or automate activities inside ITSM systems.

This specialization represents an extraordinary advance. For many years, a large part of these activities depended exclusively on the experience accumulated by the professionals responsible for the operation. Today, a good part of that knowledge can be embedded in agents capable of performing analyses with speed, consistency, and practically continuous availability.

It is hard to imagine that this movement will not keep accelerating.

Most likely we will see increasingly specialized agents emerge. Some will know Kubernetes environments in depth. Others will be trained for specific observability, security, database, network, cloud computing, or enterprise application platforms.

Soon it will be common to find organizations operating dozens of different agents, each one responsible for a specific domain of the infrastructure. Without shared context, this pattern reinforces the risk of silos of intelligence among artificial specialists.

From a productivity perspective, this scenario is extremely positive. Specialists, whether human or artificial, tend to produce more precise analyses when they work within the domain they were prepared for.

The challenge begins when the incident stops respecting those same boundaries. Anyone who works in operations knows that the most critical problems rarely stay confined to a single technology.

A behavior apparently observed in the application may originate in a change made in the infrastructure. A degradation perceived by users may result from changes in security policies, from a cloud service, from a message queue, or from an external dependency that no tool, on its own, can see completely.

In these situations, deep knowledge of a single platform remains extremely valuable, but is no longer enough, because the incident does not happen inside the tool. It happens in the operation.

The incident does not respect technological boundaries

The main virtue of a specialist has always been knowing deeply the domain in which they work. In IT operations, this was never different. Over the last decades, the growing sophistication of technologies led organizations to form increasingly specialized teams. Professionals emerged dedicated exclusively to infrastructure, networks, databases, security, cloud computing, observability platforms, and applications.

This specialization significantly increased the technical quality of operations and made it possible to keep up with the speed at which new services and architectures were incorporated into corporate environments.

With Artificial Intelligence agents, we are seeing a similar movement.

Instead of a single model responsible for all activities, an ecosystem of specialized agents begins to emerge, each one trained to interpret a certain set of information, perform specific tasks, or support decisions in a very well defined domain. It is a natural evolution and, in most cases, extremely desirable.

The challenge appears when we look at the nature of the incidents these organizations need to face.

The most critical incidents rarely follow the organizational division of teams or tools. An apparently simple change in an authentication service can cause increased latency in applications, trigger communication failures between microservices, generate queues in messaging systems, increase resource usage in the cloud, and, a few minutes later, produce an avalanche of tickets at the Service Desk. Each of these manifestations will be perceived by a different tool and, consequently, by a different agent.

None of them will be wrong. Each agent will be describing, accurately, what it is able to observe. The problem is that the incident was never restricted to any of those perspectives. It arose precisely from the relationships between them.

This distinction seems subtle, but it helps explain why modern operations continue to invest so much effort in event correlation and in building an integrated view of the environment. The goal was never just to gather information in a single place. The real challenge is to understand how seemingly independent events become part of the same causal chain when observed together.

It is precisely at this point that we realize that specialization, although indispensable, has a natural limit. It deeply expands the ability to understand one part of the operation.

But understanding the incident requires understanding the connections between all those parts.

The real challenge is not interpreting information. It is connecting perspectives.

When a major incident mobilizes an operation, there is rarely a lack of information. On the contrary. In a few minutes, dashboards start recording degradations, observability platforms show changes in behavior, monitoring tools fire alerts, ITSM systems receive new tickets, and different teams start their own investigations.

Each professional observes the problem from the area they are responsible for. Each tool presents a coherent representation of reality. Each specialized agent, likewise, tends to produce consistent analyses within the universe of information it received.

Even so, anyone who has taken part in a war room knows that, for a good part of the investigation, nobody can say with confidence what is really happening.

This apparent contradiction deserves attention. The problem is not the quality of the individual analyses. Nor is it the competence of the teams or the capability of the Artificial Intelligence agents.

The real challenge lies in connecting all these interpretations to build a common understanding of the incident, and it is precisely at this moment that we notice an important difference between answering questions and understanding complex situations.

Answering questions usually requires knowledge. Understanding an incident requires relating knowledge from different perspectives. This difference may seem merely conceptual, but it deeply alters the architecture of modern operations.

Imagine a team gathered to investigate a significant degradation in a financial services platform. The database specialist shows there are no slow queries or relevant locks. The infrastructure team confirms that servers, storage, and compute resources remain within expected limits.

Observability points to a significant increase in application response time. The team responsible for the network identifies an unusual growth in latency between two environments. In parallel, the ITSM records a continuous increase in user complaints.

All of these diagnoses may be absolutely correct, but even so, none of them explains the incident on its own.

Understanding begins to emerge only when this information stops being analyzed independently and starts to be interpreted as parts of the same story.

This change of perspective helps explain why more mature organizations usually resolve major incidents faster, even when using tools similar to those available in other companies.

The differentiator is rarely the amount of data collected or the sophistication of the platforms employed, but the ability to turn multiple perspectives into a shared view of operational reality.

It is exactly this shared view that makes it possible to eliminate incorrect hypotheses earlier, better coordinate the work of the teams, and reduce the time needed to identify the most likely cause of the problem.

When we look at this process through the lens of Artificial Intelligence, the conclusion becomes practically inevitable.

If expert people need to share context to understand a distributed incident, why would we expect specialized agents to reach that understanding working in isolation?

The intelligence of the operation will be measured by its ability to share context

In recent years, it has become common to associate the evolution of IT operations with the advance of Artificial Intelligence. This perception is understandable. Models evolved quickly, specialized agents started to perform increasingly sophisticated tasks, and the expectation of automation grew significantly.

However, when we analyze the architecture of modern operations, we realize that this transformation does not depend only on the evolution of agents.

It depends, above all, on how these agents manage to understand the environment they are part of.

Specialization remains an enormous differentiator. An agent trained to interpret logs, analyze observability metrics, follow infrastructure changes, or support ITSM processes can produce extraordinary results within its domain. The greater the specialized knowledge, the higher the quality of the analyses produced tends to be.

The problem is that critical incidents rarely stay confined to a single domain. They arise from the relationships between applications, infrastructure, networks, cloud services, security, integrations, and business processes.

It is precisely these relationships that make investigation so challenging and explain why experienced teams need to bring different specialists together to build a single understanding of the problem.

With Artificial Intelligence agents, this logic remains exactly the same.

We will have agents increasingly prepared to analyze specific parts of the operation. Some will be observability specialists. Others will master cloud platforms, databases, security, or infrastructure. All of them will be able to contribute significantly to speeding up investigations and supporting decisions.

But none of them, on its own, will be able to represent the full complexity of a distributed environment. The difference between a collection of specialized agents and a truly intelligent operation will therefore not lie in the number of agents available. It will lie in the ability to make all of them work from the same understanding of operational reality. This may be the main paradigm shift we will begin to see in the coming years.

For a long time, we invested to build platforms able to monitor systems, collect metrics, record logs, and expand observability. Now, we face a new challenge: creating an architecture that allows all this information to be turned into a shared operational context, consistent enough to guide people and Artificial Intelligences at the same time.

When that happens, agents stop acting as isolated specialists and start collaborating on the same representation of the operation. Each continues to use its specific knowledge, but their conclusions stop competing with one another and start complementing one another.

This is a subtle difference, but at the same time it may represent one of the greatest transformations IT operations have ever experienced.

The next step in this evolution

If specialized agents depend on a common context to understand complex incidents, a new question naturally arises.

Who will be responsible for building and maintaining this context?

Answering this question requires looking at a new component of the architecture of modern operations. Not an additional tool, nor a new specialized agent, but a layer able to integrate information from multiple sources, preserve the relationships between them, and make a single representation of operational reality available to all participants in the operation.

It is precisely this architecture that we will begin to explore in the next article.

We will discuss why the next generation of AIOps will stop being seen as a set of independent tools and will be built on context platforms, able to connect data, people, and agents around the same understanding of incidents.

In practice, perhaps this is the difference between using Artificial Intelligence in operations and building operations truly driven by Artificial Intelligence.

About the author

Paulo Florêncio de Menezes is an entrepreneur, partner, and co-founder of companies such as Target Solutions, BiPTT, and ARGUS.

He holds a degree in Data Processing from the Federal University of Amazonas (UFAM), an MBA in Business Management from Fundação Dom Cabral (FDC), and a Professional Master’s in Economics from Fundação Getulio Vargas (FGV).

In his Master’s research, he developed the IBEOP-IA (Brazilian Index of Potential Occupational Exposure to Artificial Intelligence), investigating the potential exposure of Brazilian occupations to AI capabilities by combining occupational data, artificial intelligence patents, and natural language processing techniques.