Your engineers did not train for years to triage the same alert at 2am. Yet that is where much of their week goes. McKinsey's analysis of agentic infrastructure finds that engineers spend a disproportionate share of time responding to alerts while also manually testing and deploying fixes. The same research estimates that agentic AI can enable automation of 60 to 80 percent of routine infrastructure work over time. That is the promise of AI in IT operations. The harder question is why so few teams have turned it into something they actually run.
This post looks at what the McKinsey research says, why most agent programmes stall at the pilot stage, and what governed AI agents for IT operations look like in practice.
The alert queue has quietly become the job
Infrastructure teams were meant to build. Increasingly, they respond.
McKinsey's article, Reimagining tech infrastructure for (and with) agentic AI, published in April 2026, puts numbers on where infrastructure effort lands. Observability, IT service management and infrastructure operations together account for 45 to 75 percent of total infrastructure labour spend. The same piece projects that IT infrastructure costs will rise two to three times by 2030 while budgets remain flat.
Put those two findings side by side and the pressure is clear. The work that keeps systems running already consumes most of the labour budget, and the systems are getting more expensive to run.
Google's SRE practice has a name for much of this work. Its Eliminating Toil chapter describes toil as work that tends to be manual, repetitive, automatable and tactical, with no enduring value, and that scales linearly as a service grows. Google's SRE organisation has an advertised goal of keeping toil below 50 percent of each SRE's time. Plenty of teams would be glad to hit that line.
Why SRE toil keeps growing
Toil grows with the system, not with the team. Every new service, region and dependency adds alerts to acknowledge, dashboards to check and runbooks to follow. Hiring does not keep pace, and the people who know where to look become the bottleneck for every incident.
The promise of AI in IT operations: 60 to 80 percent of routine work
McKinsey's headline estimate is that agentic AI can enable automation of 60 to 80 percent of routine infrastructure work over time. It also points to a 20 to 40 percent run-rate cost reduction in initial deployments.
The word that matters there is "routine". The work in scope is the repetitive investigation and response that Google's SRE book would call toil: checking the same signals, correlating the same logs, confirming the same deploy timeline. It is not the judgement call about whether to roll back a payment service during peak trading.
That distinction shapes what good AI in IT operations looks like. An agent that pulls the evidence together in minutes is valuable. An agent that also decides, unsupervised, to change production is a different proposition.
The stall: why agentic AI for IT operations rarely scales
Here is the second half of the picture. McKinsey reports that while 62 percent of organisations are experimenting with or piloting AI agents, scaling remains low. In any given business function, no more than 10 percent of respondents say their organisations are scaling AI agents.
So the potential is large and the adoption is shallow. Why?
Part of the answer is trust in what an agent will do when nobody is watching. An ops agent needs access to logs, metrics, traces and deploy history to be useful. The same access, paired with write permissions, is exactly what makes a security team nervous. Without a clear answer to "what can it see, what can it change, and who said yes", agents stay in the sandbox.
Standards bodies are converging on the same concern. The NIST AI Risk Management Framework is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems. For operations teams, trustworthiness is practical: scoped access, a human checkpoint before changes, and a record of what happened.
The condition: high-impact actions need a human yes
McKinsey's description of agent-ready infrastructure is direct on this point. It states that high-impact actions require human approval, supported by supervisory mechanisms to pause or override automated behaviour.
Cloud providers have been saying something similar for years about ordinary automation. The AWS Well-Architected operational excellence design principles recommend that teams employ automation safety by configuring guardrails, including rate control, error thresholds and approvals, and note that effective automation can reduce operator toil. The same principles favour frequent, small, reversible changes so failures can be reversed faster.
Agents raise the stakes because they reason across steps rather than follow a fixed script. That makes three design choices non-negotiable:
Scope before autonomy
Each agent should hold a defined role, a defined data scope and a defined set of tools. An agent investigating latency has no reason to read customer records.
Approval before change
Investigation can be autonomous. Anything that changes a system should stop and wait for a person with the right role.
Evidence after every run
When an agent returns an answer, engineers need to see how it got there: which tools it called, what came back and which evidence supports the conclusion. Telemetry standards such as OpenTelemetry's signals, which group data into categories such as traces, metrics and logs, give agents a consistent foundation to reason over. The run record makes that reasoning reviewable.
How Toby AI Agents help
Toby AI Agents are AI teammates you delegate engineering work to inside TrueWatch. They are built around the three conditions above.
- Defined roles and scope. You set each agent's role, data scope and tools. Roles include SRE, Security, AppDev, FinOps and Custom.
- Investigation, then a proposal. An agent investigates, returns findings and proposes fixes.
- Approval before change. Anything that changes a system waits for your approval.
- Evidence you can review. Each run keeps the tools called, what they returned and the evidence behind the answer.
- Where your team already works. Toby AI Agents work from dashboards, alerts, DQL queries, Slack or mobile, and run on alerts, schedules or questions.
In practice, that means the routine first hour of an incident, gathering signals and narrowing down a likely cause, can be delegated. The decision about what to change stays with your engineers. For a closer look at how approvals and run records are designed, read How We Designed Trust Into Toby AI Agents. To see an agent answering questions in a team channel, see ChatOps with Toby AI Agents.
FAQ
What is AI in IT operations?
AI in IT operations applies machine learning and, increasingly, AI agents to the work of keeping systems running: detecting issues, investigating causes and proposing or carrying out responses. Agentic approaches go further than alert correlation by running multi-step investigations across logs, metrics and traces.
How much IT operations work can AI agents automate?
McKinsey estimates that agentic AI can enable automation of 60 to 80 percent of routine infrastructure work over time. The emphasis is on routine work. High-impact actions, in McKinsey's own framing, still require human approval.
Why do so few organisations scale AI agents in operations?
McKinsey reports that 62 percent of organisations are experimenting with or piloting AI agents, but no more than 10 percent in any given business function say they are scaling them. Unclear access boundaries, a lack of human checkpoints and limited visibility into what agents did all make teams hesitant to move beyond pilots.
Can an AI SRE agent change production on its own?
It depends on how it is governed. With Toby AI Agents, agents investigate and propose fixes, and anything that changes a system waits for your approval.
How do AI agents reduce SRE toil?
By taking on the repetitive investigation steps that make up toil, such as gathering signals, correlating events and using AI root cause analysis to draft a likely cause, agents free engineers to spend time on decisions and engineering work.
Hand off the routine, keep the decision
The research points in one direction. Most routine operations work can be delegated over time, and the teams that scale it will be the ones that pair autonomy with scope, approval and evidence. If your engineers are still the automation layer, it may be time to give them a teammate.
Explore Toby AI Agents and see how your team can delegate investigation while keeping every change under human approval.