AI is increasing development velocity faster than existing operating models can absorb it. More code is being generated. More changes are reaching production, and systems are becoming too complex for people to understand every consequence before something ships.
As development is becoming more autonomous, operations must follow. But autonomy in production creates a different problem: how do you trust a system to act when no human can fully understand every decision it may need to make?
Trust cannot come from intelligence alone. It must be built on evidence that an agent can assess risk, operate within defined boundaries, and produce verifiable outcomes.
The first industry response was the AI SRE: an agent that investigates incidents, correlates telemetry, identifies likely causes, and recommends remediation. These systems have shown that agents can perform more meaningful operational work.
But recommendation is not autonomy. The harder problem: how to let agents act in production without requiring a person to keep every workflow moving.
That requires an operating environment that gives agents what they can’t supply themselves: context that never shows up in telemetry, explicit authority to act, and an independent record of what they did and why.
Trust has to be earned
An agent that can figure out what should happen is fundamentally different from an agent that has the authority to make it happen. Authority should expand as the agent demonstrates that it can assess risk, operate within defined boundaries, and produce the intended result.
The hardest failures aren’t obviously wrong actions. They’re reasonable actions taken without the context that makes them wrong. Say an agent sees a disk filling up and purges the oldest logs. By every signal it can see, that’s the right call. But if those logs are under a legal hold, a routine cleanup just became a compliance violation, and nothing in the telemetry would have told it so.
Access to the right tool does not mean the agent has the context or authority to use it. And when it does act, its own report that the fix worked isn’t proof: something outside the agent has to confirm what changed.
This is where most enterprises are stuck. Reasoning is improving faster than the controls around it, leaving human approval as the default safety mechanism. That is useful during adoption, but it cannot remain the permanent control plane. If a person still has to interpret every recommendation and authorize every action, the workflow is assisted, not autonomous.
Autonomy requires an operating environment
For an agent to operate independently, the system around it has to answer three questions.
Does the agent have enough evidence to act? Access to logs, metrics, traces, and tools can tell it what is happening now. It may not tell it what happened the last time conditions looked like this, or what constraints exist outside the telemetry: a deployment freeze, a change hold, or a commitment to a customer.
Does it have authority to act here, now? Governance defines which systems the agent can access, which actions it can take, and when approval is required. But authority must also account for identity, service, environment, policy, scope, and current conditions. Credentials are not the same as authority.
Can the intended outcome be verified? The result has to be observed, verified, and recorded. If the intended outcome did not occur, the system needs to know whether to continue, stop, roll back, or escalate.
Without context, authority, and an independent record, an agent can only recommend, because no one will let it do more. With them, it becomes something you can delegate work to.
This operating environment should sit above the individual agent. Organizations should be able to adopt an open-source, commercial, or internally built agent without rebuilding their operational controls each time.
Agents will change. Trust has to survive the agent.
Earn autonomy workflow by workflow
You cannot flip a switch and trust an agent with your entire production stack. Authority has to expand deliberately, starting with narrowly scoped workflows where teams can observe how the agent performs in their own environment, understand the evidence behind its decisions, and see whether those decisions produce the intended result.
Others may become routine enough that the agent can execute and verify them without intervention. The question is not whether an agent is generally trustworthy, but where it has demonstrated that it can operate reliably within known conditions.
Teams can use those outcomes to decide where the agent has earned more autonomy. If an agent consistently performs within defined boundaries and produces the intended result, operators have evidence to broaden its scope. That is a very different model from assuming a smarter agent automatically deserves more access.
Trust is a system property, not a model property
Much of the conversation around AI agents treats trust as a model problem. The assumption is that as models become more accurate, organizations will eventually be comfortable giving them more control.
I don’t think that’s enough.
In production, trust comes from knowing how a system will behave within defined boundaries. It comes from being able to see what information an agent used, what action it took, why it took it, and whether that action produced the intended result.
That means separating trust from any individual agent. Organizations need consistent controls around whichever agents they choose: operating conditions, records of decisions and actions, approval gates, and verification. As agents change, those controls provide continuity.
This is the problem we are working on at Mezmo: creating the trust layer for autonomous operations. A system of context that lets SRE teams give agents more responsibility without giving up control of production.
The operating model for autonomous operations
Humans define intent, policy, boundaries, and acceptable outcomes while agents investigate, decide, and act within those constraints. When something falls outside those boundaries, the system stops and returns control to a person.
The organizations that make this transition will not be the ones that give agents the most access. They will be the ones that create the conditions for agents to take on more responsibility without losing control of production.
Humans set the boundaries. Agents do the work.
