Key Takeaways
- Agentic AI adoption should begin with autonomous investigation and evidence-backed reasoning, not unrestricted production automation.
- The six levels of AI autonomy provide a framework for progressively delegating operational responsibilities, from explaining telemetry to closed-loop remediation.
- Advancing through these levels requires five foundations: system context, reliable telemetry, operational tools, memory and history, and governance.
- Success should be measured by operational outcomes, including faster root-cause identification, reduced manual investigation, and verified remediation—not simply AI adoption.
Where should IT teams start with agentic AI?
Agentic AI has the potential to change how IT teams investigate incidents, diagnose problems, and respond to operational issues. But moving from AI-assisted investigation to autonomous operations requires more than giving an AI agent access to infrastructure tools.
Organizations need to establish how much responsibility an agent can safely take on, what evidence it needs to make decisions, and which controls must be in place before it can act.
IT teams should start with observability and root-cause analysis (RCA) because they give organizations a relatively safe environment in which to establish trust. AI agents should earn the right to act by first demonstrating that they can investigate reliably.
An investigation agent can gather data, traverse dependencies, form hypotheses, and present evidence without initially being allowed to change production systems.
That creates a sensible progression:
Observe first. Reason reliably. Recommend next. Act later.
If the agent cannot distinguish root cause from symptoms, cannot understand topology, or cannot explain why it reached a conclusion, adding remediation authority simply automates uncertainty.
For that reason, autonomous investigation is likely to be one of the most important stepping stones toward autonomous IT operations.
The 6 levels of AI autonomy in IT operations
Autonomy should increase only as evidence quality, controls, and operational confidence increase.
A practical progression looks like this:
Level 1 — Explain: The agent interprets telemetry and answers operational questions.
Level 2 — Investigate: The agent autonomously gathers evidence, traverses dependencies, and builds an incident analysis.
Level 3 — Recommend: The agent proposes a remediation and explains the evidence behind it.
Level 4 — Execute with approval: The agent prepares the action, but an engineer authorizes execution.
Level 5 — Execute within guardrails: The agent independently performs a defined set of reversible, low-risk actions.
Level 6 — Closed-loop autonomous operations: The agent detects, investigates, acts, verifies the result, and continues monitoring—escalating when risk, policy, or insufficient evidence requires human intervention.
Not every workflow needs to reach Level 6. Restarting a non-critical service and failing over a production database should not have identical autonomy policies.
The objective should be appropriate autonomy, not maximum autonomy.
What does it take to move from one level to the next?
The six levels describe the progression toward autonomous operations, but they don’t determine whether an organization is ready to advance. That depends on the quality of the underlying operational environment.
For example, an agent may be able to explain a performance issue using telemetry alone. But to investigate the root cause, it also needs to understand how applications, services, and infrastructure depend on one another. To recommend remediation, it needs sufficient evidence to evaluate possible actions. And to execute those actions safely, it needs controlled access to operational tools, clear permissions, and the ability to verify the outcome.
In other words, greater autonomy requires greater system understanding, stronger evidence, and more robust governance.
These requirements are not separate from the autonomy model. They are what make progressing through it possible.
What AI agents need to succeed in IT operations: 5 foundations
An effective operational agent needs at least five foundations.
1. System context
The agent must understand relationships among services, workloads, infrastructure, networks, storage, and dependencies.
This becomes increasingly important as agents move beyond explaining individual signals to investigating root causes and determining which actions could affect other systems.
2. Reliable telemetry
Metrics, logs, traces, events, configuration, and topology provide the evidence on which reasoning depends.
Without reliable evidence, an agent cannot consistently distinguish symptoms from causes or verify that a remediation actually worked.
3. Operational tools
Agents need controlled mechanisms for querying systems, running diagnostics, invoking workflows, and performing approved actions.
As agents progress from recommending actions to executing them, these interfaces become essential to operating within defined boundaries.
4. Memory and history
Previous incidents, normal behavior, configuration changes, remediation outcomes, and operational knowledge can improve decision quality.
This context helps agents evaluate current conditions against past behavior and learn which responses have been effective.
5. Governance
Authentication, authorization, action policies, auditability, approval boundaries, rollback mechanisms, and escalation paths determine how safely autonomy can expand.
Governance is especially important at higher levels of autonomy, where agents may be permitted to execute actions without individual human approval.
This is why simply placing an LLM in front of existing dashboards tends to produce limited results. An agent needs enough trustworthy system context to make a defensible operational decision.
Virtana’s architecture reflects this principle by bringing operational dependencies together rather than treating telemetry as disconnected collections of metrics.
How the five foundations support the six levels of autonomy
The relationship between these two frameworks is straightforward: the levels define what an agent is authorized to do, while the foundations provide the capabilities and safeguards needed to do it reliably.
At the earliest levels, reliable telemetry and system context support explanation and investigation. As agents begin recommending actions, historical context and access to diagnostic tools become more important. At higher levels, operational interfaces and governance determine which actions can be delegated, under what conditions, and how their outcomes will be verified.
All five foundations matter throughout the progression. What changes is how much organizations depend on them as agents take on greater operational responsibility.
This also means organizations should not measure readiness solely by whether an agent can perform a particular task. They should evaluate whether the agent can perform that task consistently, explain its reasoning, operate within policy, and demonstrate that its actions produced the intended outcome.
How to measure agentic AI in IT operations: 9 KPIs
Measure the operational work being removed, not the number of conversations people have with an AI interface.
Useful measures include:
- Time from detection to a credible root-cause hypothesis
- Percentage of incidents investigated without manual telemetry gathering
- Number of alerts consolidated into actionable incidents
- Percentage of recommendations supported by verifiable evidence
- Operator acceptance of proposed remediations
- Successful autonomous actions versus rollbacks
- Reduction in manual investigative steps
- Time from remediation to verified recovery
- Percentage of incidents requiring human escalation
These metrics also help organizations determine when it makes sense to advance to higher levels of autonomy. For example, consistently accurate investigations and evidence-backed recommendations can help establish confidence before agents are authorized to execute remediation workflows.
The goal is not simply to increase the number of autonomous actions. It is to improve operational outcomes while maintaining appropriate control.
Building toward autonomous IT operations
In a safe and effective operational model, humans retain judgment while agents absorb more of the repetitive investigation, evidence gathering, and low-risk execution.
Machines are well suited to continuously observing large volumes of telemetry, traversing dependencies, comparing behavior over time, executing repetitive diagnostics, and validating known remediation patterns.
Humans remain better positioned to handle architectural trade-offs, business priorities, novel failures, ambiguity, and high-consequence decisions. Let agents absorb the investigative and repetitive work so engineers can focus on judgment.
For Virtana, this is where observability and agentic AI converge. Observability provides the evidence and system understanding. Agents turn that understanding into reasoning and action. Governance determines how far that action can go.
The progression toward autonomous IT operations is therefore unlikely to be one giant leap. It is more likely to look like:
Better Context → Autonomous Investigation → Evidence-backed RCA → Recommended Action → Governed Execution → Continuous Verification
Organizations that establish that foundation first will be better positioned to introduce autonomy safely than organizations that begin with the agent and try to solve the context problem afterward.
“The future of ITOps is not AI watching more dashboards. It is AI investigating the system on behalf of the engineer.”
Explore practical applications in our related blog: 9 Agentic AI Use Cases in IT Operations: From Observability to Autonomous Operations.
Explore the Virtana Agentic Observability Platform
Frequently Asked Questions About Adopting Agentic AI in IT Operations
Where should IT teams start with agentic AI?
Autonomous investigation is a strong starting point. Allow the agent to collect evidence, correlate telemetry, traverse dependencies, and produce an explainable diagnosis before giving it permission to modify production systems.
Does autonomous IT operations mean removing humans from operations?
No. In most enterprise environments, autonomy will be bounded by risk and policy. Agents can increasingly handle repetitive investigation and low-risk remediation while engineers retain authority over ambiguous, irreversible, novel, or high-impact decisions.
What is required before an organization can safely adopt autonomous operations?
Reliable telemetry, accurate dependency context, controlled operational interfaces, permissions, audit trails, rollback mechanisms, outcome verification, and clear escalation policies are fundamental. Autonomous operations is ultimately a systems engineering and governance problem as much as an AI problem.
Sankar Nagarajan
Principal Data Scientist
