Let the AI SRE Read Everything, Write Almost Nothing

The pitch for an AI SRE is that it fixes production before you wake up. The question the pitch skips is what happens the night it breaks production before you wake up.

A new category has a name now. An AI SRE is an autonomous agent that detects, investigates, and resolves incidents, wired into your observability stack, your infrastructure, your repositories, and your comms. The vendors report striking numbers: investigate one hundred percent of alerts, root-cause in under five minutes, mean time to resolution down by as much as eighty percent, with customer figures in the seventy to ninety percent range. Take those as vendor-reported and un-audited, because they are. The underlying value is still real. On-call is brutal, alert volume is inhuman, and a system that triages every alert instead of the few a tired engineer gets to is a genuine gain.

But read the category name literally. You are putting another non-deterministic actor on production, the exact actor I worried about in The Agent Broke Prod at 2 A.M. and Left No Note. The move that makes this safe is not trusting the vendor’s autonomy slider. It is separating the two jobs the name quietly bundles.

Two jobs wearing one name

An AI SRE does investigation and it does remediation, and they are not the same risk.

Investigation is a read. Query the metrics, the logs, the traces, and the deploy history, form several hypotheses at once, and produce evidence with a confidence score and a dependency chain. Nothing about the running system changes.

Remediation is a write. Roll back the deploy, restart the service, change the config, scale the group. The state of production is now different because a probabilistic agent decided it should be. Bundling both under one autonomy setting, so that “let it resolve incidents” silently grants “let it change prod,” is the mistake that turns a good tool into an incident of its own.

Investigation is the easy yes

Give the reading job all the autonomy you have. This is where the toil lives and where the AI actually earns the category.

A human debugs sequentially, one hunch at a time, at three in the morning. An agent tests many hypotheses in parallel against the whole stack at once, and it does it for every alert rather than the handful a person can reach. That is a real difference in kind, not a faster script. It is also the line the category draws against classic AIOps, and the line holds: AIOps correlates events and compresses noise into clusters, then stops. It does not build the causal chain or read the code that shipped an hour before the spike. Full-speed investigation is safe because it changes nothing, and it is the part of the pitch that is not hype.

Remediation is a write, and a write needs a gate

The moment the agent acts on production, the ordinary rules of change control apply, and they do not get a waiver because the actor is clever. A wrong fix executed autonomously has the same blast radius as a wrong fix executed by a script, minus the determinism that let you predict what the script would do.

So the remediation job runs at a lower autonomy than the investigation job. Recommend by default. Require a human to approve the write. Make every action reversible, and make it produce a record of what changed and why. This is not distrust of the tool. It is the same posture you would demand of any new operator with production access, applied to an operator that reasons in probabilities.

The AI SRE needs a trace too

Here is the part the vendors do not put on the slide. The actor you are hiring to close the observability gap must not widen it. If the AI SRE queries a dozen systems and changes three, and leaves no attributable trace of what it looked at and what it touched, you have added an actor you cannot run a postmortem on. That is the failure I described before, now wearing a helpful uniform.

The requirement is concrete. The AI SRE has to emit its own telemetry into the same plane it reads from: what it queried, which hypothesis it acted on, what it changed, under whose approval. Its actions have to be as traceable as the services it watches, or it is not ready for regulated production no matter how good the demo looked.

Both sides of the pager

The operator case is strong and I do not want to wave it away. Fewer pages at three in the morning, root-cause in minutes instead of hours, and a junior engineer who can operate like a senior during an incident are real goods, and the toil an always-on investigator removes is toil no human should have been carrying. An organization that refuses this on principle is choosing to keep burning people on work a machine does better.

The control case is just as real. A non-deterministic actor with write access to production is a new risk surface, its changes have to be auditable and reversible, and every headline number attached to the category is vendor marketing until your own environment proves otherwise. Resolve it with the trust ladder: an AI SRE belongs at investigate-freely, recommend-remediation, human-approves-writes in regulated prod, and it climbs only as its own actions earn a trace as good as the systems it watches. The control plane, read-only by default with gated and reversible writes, is what lets you say yes to full-speed investigation without betting the core on a probabilistic fix.

The honest limit

The dream the category sells is the fully autonomous fixer, and in regulated production you do not get that on day one. You get a superb investigator and a gated hand, which is less cinematic and more correct. The stats are ceilings, not guarantees, and “up to eighty percent” is doing a lot of work in that sentence.

There is a labeling problem too. “AI SRE” is marketed onto three different things: autonomous investigation agents that diagnose but still need a separate paging tool, incident-management platforms like incident.io and PagerDuty that layer AI onto a workflow that still wakes a human first, and observability products with an AI feature bolted on. Know which one you are buying, because the read-versus-write split lands differently on each.

Split the verbs and the answer gets simple. Let the AI SRE read everything, because reading is where the toil is and the risk is not. Let it write almost nothing, and only through a gate that a human opens and an audit log remembers. The category is worth adopting. The autonomy slider is not the feature. The gate is.

---

If this resonated, read The Agent Broke Prod at 2 A.M. and Left No Note, on postmortems for actors that leave no trace, and The Trust Ladder, on calibrating how much autonomy an agent has earned.

Find me on X @orestesgarcia or LinkedIn /in/setsero.