LibraryAgentic operations, honestly
Agentic operations, honestly
Most of what's marketed as agentic autonomy in operations today is closer to a fast, well-organized recommendation engine than to an actor making its own consequential decisions, and that gap between the word and the practice matters before adopting any of it. This piece works through where autonomy is safe today, where it isn't, and the four-stage trust model that separates the two.
The word doing more work than the product
Ask five vendors in this category what "autonomous" means and you'll get five different answers, and at least two of them will describe a system where a human approves every consequential action, which is a defensible design and a strange thing to call autonomous. This isn't dishonesty so much as a category still settling its vocabulary while everyone in it needs a word that sounds ahead of where a buyer's trust actually is.
The more useful question isn't whether a system is autonomous. It's which of four specific things it does: observe, calculate, propose, or act, because those four are genuinely different capabilities with genuinely different risk profiles, and conflating them under one word is where most of the category's overclaiming actually happens.
The four stages, and why 'act' is rare
Observe means the system reads and summarizes without producing a recommendation, closer to a well-organized status report than an opinion. Calculate means it derives a number or a ranking from data, still without recommending what to do about it. Propose means it recommends a specific bounded action for a named human to approve or reject. Act means it executes a consequential change without a human approving that specific instance first.
Almost everything currently shipping in enterprise operations sits at propose or below. PagerDuty's SRE Agent can act on its own recommended remediations or wait for approval, with a fully autonomous responder stated as a target for later in 2026 rather than something live today (PagerDuty: Spring 2026 release). Cleric ships read-only by default, escalating to write access only when a team decides it's ready (Cleric: AI SRE). That's not the industry moving cautiously out of timidity. It's the industry running into the actual difficulty of the last stage, a genuinely different engineering and trust problem than the first three.
Where autonomy is safe today
Autonomy is safest where the action is fully reversible, bounded in blast radius, and where the cost of a wrong action is closer to an inconvenience than an incident. Restarting a single stateless worker process, re-running a health check, or drafting a summary for a human to review before anything ships are all reasonable candidates for genuine act-level autonomy, because getting them wrong costs seconds and a retry, not customer data or downtime.
The pattern across the field's more credible act-level claims is narrowness, not broad capability. A system that can autonomously do one specific, well-bounded, reversible thing is a more trustworthy claim than a system that says it can operate broadly with a human somewhere in the loop for the important parts, because "the important parts" is exactly where the line between safe and unsafe autonomy actually sits, and it's the part vendors are vaguest about.
Where it is not, and the honest reasons why
Autonomy is not safe today where an action is hard to reverse, where the blast radius crosses a service boundary the acting system can't fully see, or where getting it wrong has a compounding cost. A bad remediation applied to a claims-processing pipeline that keeps running for six hours before anyone notices is a materially worse outcome than the original incident. Gartner's own framing of the category, moving "from AIOps to Agentic Ops," comes paired with a specific and sobering prediction: more than 40 percent of agentic AI projects will be cancelled by the end of 2027, for cost, unclear value, or inadequate risk controls (Gartner: agentic AI cancellations forecast).
That prediction is worth sitting with rather than arguing away. Inadequate risk controls, named explicitly as one of the causes, is not a claim that autonomy is impossible. It's a claim that a large share of current deployments are reaching for act-level autonomy before the evidence discipline, separation of duties, and rollback machinery underneath it are actually ready, and that gap between claim and readiness is what causes the cancellation, not the ambition itself.
The graduated-trust model, and what earns the next stage
A graduated-trust model treats the move from propose to act as something an agent, and the platform around it, earns through a visible track record, not something granted on day one by a licensing tier. The ceiling for a given workflow should be a setting an accountable human can see and change, with a record of who changed it, and the ceiling should default down, not up, when the evidence backing a proposal gets thinner than usual.
Dynatrace's position, that causal AI should produce the answer and the agent should act under what it calls supervised autonomy (Dynatrace: third-generation platform announcement), is one credible version of this model. Rootly's confidence-ranked hypotheses are another, making the strength of the evidence itself a visible, graded thing rather than a binary yes or no (Rootly: AI SRE). The specific mechanism differs across vendors. The shared shape, evidence and trust both scaling up gradually and visibly, is what separates a graduated model from a marketing dial that always reads "autonomous" regardless of what's actually happening underneath.
How to test where a vendor's ceiling actually is
The fastest way to find out whether a vendor's autonomy ceiling is real is to ask what happens when the evidence backing a proposal is weaker than usual: a stale source, a low-confidence hypothesis, a condition the agent hasn't seen before. A system with a genuine graduated-trust model will describe, specifically, how its behavior changes. It holds at propose instead of moving to act, it flags the specific piece of evidence that's thin, or it abstains outright rather than guessing.
A system without a real ceiling will describe the same scenario in almost identical language to its normal operation, because the marketing word "autonomous" doesn't actually change behavior under degraded conditions, it just describes the intended behavior under ideal ones. The Register's April 2026 survey with NeuBird is useful here again: 60 percent of respondents cite lack of trust as the top blocker to agentic operations (The Register: survey of SREs on AI agents in production), and a vendor's answer to what happens when the evidence is weak is one of the fastest ways to find out whether that trust would be well placed.
None of these three require a bad actor or a broken model.
The failure modes teams actually hit
Three failure modes show up more often in practice than the dramatic scenario of an agent doing real damage. The first is silent scope creep: a workflow approved for propose-only gradually accumulates broader effective authority because nobody revisits the ceiling once it's set, and eighteen months later the workflow is doing more than anyone remembers agreeing to. The second is approval fatigue: a human approver, faced with dozens of well-formed proposals a day, starts approving without reading, which makes the approval gate real in the audit trail and fictional in practice. The third is confidence laundering: a low-confidence hypothesis gets presented with the same visual weight as a high-confidence one, and a tired approver treats them the same.
None of these three require a bad actor or a broken model. They're organizational failure modes that show up around a working system, and they're also the reason a graduated-trust model needs a human-side design, not just a technical one: approval load has to stay low enough that approving remains a real act of judgment, and confidence has to be visually distinguishable, not just numerically present somewhere in a tooltip.