All posts
Muhtalip Dede profile photoMuhtalip Dede · Founder of kprompt3 min read

Building AI SRE in Public #10: Autonomous SRE — and why not yet

Why unsupervised auto-remediation is not the destination. Observe by default, Autopilot propose-only, reality anchors, and investigate → plan → approve → verify as the load-bearing loop — not a fleet of agents that apply because the model sounded sure.

This is episode 10 — the closer — of Building AI SRE in Public. Episodes 1–9 built the machinery: intent → typed plan → safety → multi-context → gated investigation → chronology → local memory → topology. The marketing temptation is to call that stack “autonomous.” We refuse. Autonomy without an approval boundary is how AIOps burned trust the first time.

The claim

AI SRE means investigate with evidence, propose a reviewable PlanResult, fail closed on hard denies, and verify after apply. It does not mean a thousand agents patching prod because a chat session soft-agreed. “Autonomous” is allowed only where policy + explicit gates say so — and even then the default remains proposeOnly. Silent apply is not shipped as the product story.

What people hear when you say autonomous

PitchWhat operators hearWhat we ship instead
Self-healing clusterSomething mutated while I sleptObserve alerts; human or policy gate before mutate
Agent fleetWho owns the blast radius?Namespace-scoped Roles; Coordinator probes, not god-mode
LLM decidedNo audit trail I trustPlanResult + audit + Reality anchors the model cannot waive
Auto-remediate from graphEdges became root causeGraph/memory bias Explain — never sole proof / never sole apply

AIOps already tried unsupervised heal

Correlation engines promised auto-remediation before LLMs. Many failed for boring reasons: brittle rules, noisy alerts, opaque black boxes, and remediations operators would not stake a pager on. Better language models do not erase that history. They make confident wrong plans cheaper to generate. The fix is not a louder model — it is a compiler temperament: typed artifacts, anchors, and humans (or explicit policyAuto) on the mutate path.

The loop we will defend

Load-bearing path

investigate / why / timeline / impact
        → Investigation (EvidenceRef, Unknowns, degraded[])
        → optional PlanResult (actions, risk, blastRadius)
        → Safety hard-deny / risk
        → human approve  (or policyAuto + allowlist + apply=true)
        → apply
        → post-apply verify

Skip any step and you are back to folklore with kubectl privileges. Soft-agree in the same session is not verify. Memory is not proof. A Knowledge Graph edge is not a rollback.

Autopilot without autonomy theater (ADR-0015)

  • Observe remains the default install — read Role, notify, no in-cluster apply implied
  • Autopilot is opt-in and allowlist-only (rollback / restart / scale / evict — named targets)
  • proposeOnly is the MVP default: emit PlanResult / proposal; human applies with --approve
  • policyAuto still requires allowlist + apply=true + explicit gate — never LLM-said-so → apply
  • Deny pack: wipe / ns delete / Secret values / fabricated evidence — never allowlistable

Propose, don’t surprise

kprompt agent run -n payments --analyze --heuristic --autopilot-propose
# Apply only with policyAuto + explicit approve — never the silent default
kprompt agent autopilot apply-proposal --file proposal.json --approve --policy ./policy-auto.json

Reality anchors beat second opinions

If an improvement loop can rewrite both the solution and the evaluator, Goodhart wins. Hard deny, PlanResult schema, EvidenceRef kinds, pre-trust caps, post-apply verify, AG-034 memory caps, and Coordinator probe Evidence live in code — not in a prompt that says “be careful.” A second LLM in the same session is not an anchor.

What “not yet” allows later

Narrow policyAuto for boring, reversible actions under RemediationsPolicy can grow. GitOps remains the steady-state source of truth for desired state; Autopilot is incident remediation, not continuous reconcile of everything. Full unsupervised SRE — free-form mutate, cluster-wide god agents, Secret-value CMDB, silent heal from chat — stays an explicit non-goal until a new ADR says otherwise in public.

What ships vs building vs refuse

  • Shipped: plan → safety → approve → apply; Observe; Autopilot propose + gated apply; Investigation / timeline / impact / graph MVP
  • Shipped: reality anchors docs; memory evidence-not-proof; soft-agree confidence caps
  • Building: richer verify, topology UI, deeper Prom/OTel/mesh hops
  • Refuse: silent apply as default; “1000 agents” fleets; memory/graph as sole proof; model-waived hard denies

Series close

If you only remember one sentence from ten episodes: AI SRE is a compiler and an approval boundary, not a chatbot with cluster-admin. The wedge ships today. The destination stays honest. Star the repo, open issues when an episode overclaims, and keep the human (or an explicit policy gate) on the mutate path.

Related posts