Skip to main content
This chapter places agents next to the tools you already run, explains where AIOps stopped short, and covers the three technical changes that made agents practical. Use it to judge which parts of your current stack an agent platform will reuse and which gaps it has to fill.

​
2.1 Four generations of operations

Each generation builds on the one before it instead of replacing it. Agents express changes as code (Gen 2), take correlated alerts as input (Gen 3), and still write and run scripts (Gen 1). What changes is who closes the loop. That has a practical consequence: an agent is only as good as the stack under it. Before you start, check four things:
  • Infrastructure in code. The systems agents will touch are at least partly defined in Terraform or another IaC tool.
  • Alerts you can route. Your monitoring tools can send alerts by webhook. See Connect Pulse sources.
  • Runbooks written down. Your known fixes live in Confluence, a Git repository, or Markdown files. See Runbooks.
  • Read-only credentials. You can issue a scoped, read-only credential for each cloud account or cluster. See Connections.
Chapter 9 has the full readiness check.

​
2.2 Why AIOps fell short

AIOps earned its place. Event correlation and deduplication work, and they cut alert volume. But the tools stopped at “here is a group of alerts,” and a person still had to do the rest. Three gaps set the ceiling:
  1. Correlation without causation. Grouping fifty alerts into one incident helps. It still doesn’t tell you the root cause or what to do about it.
  2. Answers without reasoning. An ML score with no explanation is hard to trust. Engineers re-checked the output by hand, which removed most of the time saved.
  3. No hands. AIOps could open a ticket or call a webhook. It couldn’t investigate, test a hypothesis, pick a fix, apply it, and confirm it worked. The engineer stayed the one who acted.

​
2.3 What changed: reasoning models, tools, and protocols

Three changes made agents practical for operations work.
  1. Reasoning models. Large language models (LLMs) can now read logs, configuration, and code, form a hypothesis about the cause, and plan a multi-step fix in a well-scoped domain.
  2. Tool use. Models can reliably call functions: run CLI commands, query APIs, run kubectl or Terraform, and read dashboards. That turns reasoning into action.
  3. A standard way to plug in tools. The Model Context Protocol (MCP) is an open standard for exposing tools to AI agents. A team can put one MCP server in front of an internal system and any compatible agent can use it.
Operations suits agents for one more reason: results are easy to check. A fix either brings latency back under target or it doesn’t. A Terraform plan applies cleanly or it fails. A health check passes or it doesn’t. When the feedback is that clear, an agent can test its own work, and you can see whether it did.

​
2.4 How the industry is rolling agents out

The major cloud providers now ship their own operations agents: AWS DevOps Agent, Azure SRE Agent, and Gemini Cloud Assist on Google Cloud (3.2 covers how each one handles autonomy). They launched them the same way: investigate first, and keep any change behind the customer’s approval. That pattern is the lesson for your own rollout. Start with agents that read and explain, check their analyses against what your engineers find, and only then let them act, one kind of action at a time. Chapter 7 and Chapter 9 turn this into a step-by-step plan.

​
2.5 Where CloudThinker fits

CloudThinker’s Frontier Investigation Agents run the detect, analyze, resolve, validate loop on the stack you already have, reusing each layer instead of replacing it: A first hour in a new workspace:
  1. Add a read-only cloud or Kubernetes connection. The Quickstart walks through it.
  2. Point one alert source at Pulse.
  3. Check the Approvals defaults. Switch to Manual if you want a person to approve every write while you evaluate, and under Run types override Automations to Manual too, since that row doesn’t follow the workspace. A chat can also pick its own mode.
  4. Send a test alert with the Resolve quickstart and watch CloudThinker investigate it in Resolve.
Key takeawayAIOps made systems visible. Agentic operations makes them operable. The difference is the closed loop: observe, reason, act, and check the result, with people supervising instead of doing every step.

​
Next steps

Chapter 3: What Agentic Infrastructure Operations Actually Is

Get the definition, the autonomy spectrum, and five questions to test any vendor that calls its product an agent.

Quickstart

Connect a system and get your first answer from CloudThinker.