AI incident response demos beautifully and disappoints in production, for a structural reason: demos showcase the novel, interesting failure, and production is dominated by the same handful of signatures recurring endlessly. For those, a model is the wrong tool — it's slower, more expensive, less auditable, and occasionally confidently wrong about something a lookup table already knew. At 3am you don't want creative.
An agentic operations workflow built on deterministic rule-engine orchestration over an RCA knowledge graph. Known signatures route deterministically and return an auditable answer in seconds. Genuinely novel failures — the ones with no matching pattern — escalate to specialist agents that can reason across signals. The graph is the memory; the agents are the exception handler.
Deciding where the line sits, and being honest that it moves. Every pattern you promote into the deterministic path makes the system faster and cheaper but adds maintenance. Every pattern you leave to the model costs latency and tokens. That boundary is a product decision, not an engineering one, and it needs revisiting as the failure distribution shifts.
The cost curve matters as much as the accuracy curve, and most of this category is priced as though it doesn't. Sending every alert to a frontier model is a great margin story for the vendor and a bad one for the buyer. Hybrid isn't a compromise on the way to full autonomy — for operations, it's the correct architecture.