Who Watches the Watcher? Operations When AI Closes the Loop
For a mixed audience of executives, operations and platform engineers, architects, risk functions and employee representatives
IT operations holds the broadest credentials in the estate and is the place where loops have long been closed without a person in them. When AI observes, diagnoses, changes and restores services, the old risk gets faster: a loop that repairs itself, verifies itself and reports green on its own evidence. The keynote presents the answer of AI Operations in one line of argument: match autonomy to what can be undone, give it a budget that errors consume, keep the verifier, the observer and the stop outside what they watch, treat recoverability and competence as dated claims, and keep a named person who answers.
6 min
Two nights, one outage
The same broken release, handled slowly with evidence in one organisation and at machine speed by an agent in the other.
The second night shows a loop that closes itself and reports success on its own evidence, which the human-factors research described decades ago.
The question of the book: what may a machine do on its own in operations, who set the limit, and what can the organisation show afterwards?
7 min
Operations was shaped by scarce attention
The ticket queue, the runbook, the rota and the change board are devices for rationing attention; this reading is the book's own.
Six pressures now exceed that shape, and AI arrives because it can attend at scale.
AI lowers the price of reading; it does not lower the price of deciding or of being accountable.
8 min
Autonomy matched to reversibility, with a budget
Five functions and eleven action classes, each with a ceiling set by reversibility, blast radius, evidence and window.
Errors counted by the observer consume the budget; raising a level is a named decision and lowering it is immediate.
Level 4 Autonomous is never used for irreversible actions on production data, outside a window or in a freeze on a critical function, to disable the observation or the stop path, or to decide about a named person's access to work.
9 min
The observer principle
Public reports from large operators show verifiers, observers and stop paths that shared a fate with the system that failed; none of those cases needed an AI agent.
Three tests: independent verification, an observer that does not depend on the observed, and a stop path that works when the platform does not.
The operator's AI reads text that others write and holds administrator reach, so authority comes from a mandate enforced outside the agent.
8 min
Resilience and competence are claims
A recoverability claim has a subject, a scenario, an objective, a measured result, a date and an expiry, and only a verified claim counts.
Both fictional organisations start the book unable to say recoverable for a service whose last test failed.
A craft that daily work no longer supplies is supplied on purpose: manual runs with the agent off, dark days and seeded-error drills.
7 min
Will anyone be on call in 2036?
Observable, expected and speculation kept apart: bounded remediation of reversible classes is observable, unattended recovery of whole estates is speculation.
The verdict: a named person answering for each Tier 1 service is expected, and whether the organisation can still operate by hand is decided now.
Five things to do on Monday, each a written record from what the organisation already has.
What the audience takes away
Give every operations agent a ceiling per action class, a budget and a stop that someone outside its platform can pull without approval.
Ask of the last automatic repair what verified it, and whether the verifier shared a model, a signal, a credential or a failure domain with the actor.
Say recoverable only where a dated, attested, independently measured test stands behind the word.
Module 1 · Part I · The Operations in Question · 45 minutes
From the Queue to the Control Loop: The Frame of AI Operations
The lecture carries the argument of Part I in one line of reasoning. Operations took its shape from scarce attention; six pressures now exceed what that shape can absorb; AI arrives because it can attend at scale; and attention bought without bounds and independent verification becomes a concentration of risk. The lecture then introduces the frame the book answers with: five functions, degrees of delegation per action class, an autonomy budget that errors consume, four prohibitions on Level 4 Autonomous, the three tests of the observer principle, and resilience as a dated claim.
7 min
Two nights, one outage
Tell the illustrative scenario of Chapter 1: the same broken release handled slowly and with evidence at the regional authority, and at machine speed by a Mode 5 agent at the insurance group.
The faster night is not the better one: a loop that closes itself and reports success on its own evidence is the failure the book is about.
State the five-part thesis and what the book says would show it wrong.
8 min
What operations did before, and which scarcity each model answered
Six models from the sysadmin with a runbook to first-generation AIOps, each a device for rationing attention; this reading is the book's own interpretation.
The survey finding on external change approval, with its three cautions, and the four ideas kept from SRE: reliability as a target with an error budget, the toil cap, the standard for a page and blameless review.
AI lowers the price of reading; it does not lower the price of deciding or of being accountable.
8 min
Six pressures and three grades of evidence
Complexity and dependency, change volume, telemetry cost, people and skills, compute and energy, duty and adversaries, each landing on named functions.
Keep measured, surveyed and argued evidence apart: the provider reports of 2025 are measured, the delivery and observability surveys are surveyed, the review-capacity argument is argued.
The common structure: more to attend to, the same number of people and hours.
10 min
The loop, the action classes and the autonomy budget
O1 Observe, O2 Diagnose, O3 Change, O4 Restore and O5 Sustain hand work to one another through records; the policy decision point, the observer and the resilience register sit outside the loop on purpose.
A ceiling per action class is the lowest of four answers: reversibility, blast radius, evidence and window.
The budget turns the degree into a control: errors counted by the observer consume it, a review is held at 70 per cent and the class falls to Level 2 at 100 per cent.
The four cases in which Level 4 Autonomous is never used, each with its mechanism.
7 min
Observer principle, resilience as a claim and Tier 0
Three tests: independence of the verification, independence of the observer from what it observes, and a stop path that works when the platform does not.
Only a verified claim may be called recoverable, and evidence expires by clock or by substantive change.
The operator's AI holds the broadest credentials in the estate and is contained as Tier 0.
5 min
Two organisations, one question
Nordvik Region asks what operations becomes and what it can prove about recovery (AIDR-0900); Hansa Mutual asks how far the agent's autonomy may reach (AIDR-0950).
Both hold a recovery test that failed on time and has no re-test, so neither may write recoverable for that service.
First steps that need no AI: the inventory, the practice register, the dependency map and the delegation profile.
What the audience takes away
Operations is transformed from handling a queue to designing, bounding and verifying closed loops; the accountable person remains.
A degree of delegation is set per function and action class, capped by reversibility, blast radius, evidence and window, and kept only while the autonomy budget lasts.
What verifies an action must be independent of what performed it, and recoverability is a claim with a date, a result and an expiry.
The Craft: Five Functions, One Rule About Who Verifies
Eight chapters treat observing, diagnosing, changing, restoring and sustaining, first without AI and then with it. The lecture follows one release through the loop to show the argument of the part: in every function AI is useful where the work is large and repetitive, its failures fall on the rare and important event, and the control is never a property of the model but a policy enforced outside it, a ceiling per action class, an independent probe and a record with a date. The lecture ends with the debate of Chapter 10 on whether AI may remediate production on its own.
10 min
O1 Observe: from signals to an objective someone owns
The unit of observation is the user journey, not the host; an indicator, an objective and an error budget turn telemetry into a basis for decision.
Burn-rate alerting with two windows pages a person when the budget is being spent fast enough to matter.
The observer is a service with failure modes of its own: the Lumenscope ingestion failure left Hansa Mutual blind on 14 services for 3 hours 10 minutes.
8 min
Observing with AI: failures of silence
Correlation, baselines and summaries help where the stream is large and repetitive; the risk is the suppression of the one alert that matters.
The control is a correlation policy: no alert on a customer-facing objective is suppressed above Level 1 Assisted, holds expire, and stop conditions are numbers.
The first evidence is the operator's own golden incident set, held outside the system under evaluation.
8 min
O2 Diagnose: the assistant as evidence, never authority
Published benchmarks are a map of difficulty and not a rate that transfers to another estate.
Automation bias is not removed by training or instruction, so the design puts evidence before verdict and requires a second hypothesis with a refuting observation.
Declaration, acceptance of a hypothesis and regulatory classification stay with named people, and the record keeps the assistant's wrong contributions.
12 min
O3 Change: provenance, policy and limited exposure
A draft's authority comes from provenance, policy and review, never from its form; the gate computes the class from the diff.
Review is designed: a named reviewer who is neither requester nor drafter, a cap on open drafts and seeded errors.
Configuration is the dangerous change: it travels by the fastest path with the weakest checks, so every change that alters runtime behaviour passes the first ring.
The verifier is not the releaser, and state engines supply hold, abort and promote but not independence.
10 min
O4 Restore: runbooks as code and the debate on autonomous remediation
A runbook manifest names the action class, the level, preconditions, an independent probe, a rollback or hold, a stop and an owner.
Engines guarantee that a procedure progresses, not that its effect happens once.
Concern and calm agree on class, reversibility, independent verification and a stop path outside the platform; the verdict is given per action class.
8 min
O5 Sustain: margins and learning
An agent that optimises cost sees redundancy as waste; floors tied to dated restore tests, windows and a veto keep the margin.
An action closes only when its re-test passes; implemented but unverified is reported as open.
AI may draft the timeline of a review, and people write the analysis.
4 min
What the two organisations show
Hansa Mutual delegates by design and can extend quickly, which is also how it can extend too far.
Nordvik Region delegates by approval and slowly, which keeps it within what a team of seven can supervise.
What the audience takes away
In every function the control is a policy enforced outside the model: a ceiling per action class, a stop condition written as numbers and a record with a date.
What verifies a change, a remediation or a saving must be something other than what performed it, with its own identity, data path and failure domain.
An organisation's own measurements, such as a replay set, a golden incident set and a seeded-fault test, are the evidence that transfers; published figures are a reason to try a method.
Module 3 · Part III · Operating AI Systems · 45 minutes
Operating AI Systems: Change Without a Deployment
A service that contains a model, a prompt, a retrieval index and tools can change its behaviour when a provider replaces a model, an index goes stale or serving infrastructure fails. The lecture follows the argument of Part III: make every source of change a recorded one, measure quality with graders and sentinel sets that are not the model under test, class an AI incident at the first signal and put the stop before the diagnosis when an agent has left its mandate, keep one clock sheet per service, and bound cost with limits enforced where the agent cannot reach.
8 min
Why an AI service is different to operate
Behaviour moves without a deployment: provider-side change, serving faults, input drift and nondeterministic serving are documented now.
A provider's own evaluations did not capture a quality degradation that users noticed, so the measurement belongs with the operator.
The first move is to make model, serving, prompt, index, tools, parameters and evaluation set versioned and recorded in a release manifest.
10 min
Quality objectives and the release path
Quality, restraint, freshness and drift become objectives; restraint has a budget of nothing.
The grader is not the model under test, a sentinel set runs continuously, and the objective's data path is separate from the service's.
The release path is offline gate, shadow, canary by case, ramp, with pinning and a fallback chain in which every link is itself evaluated.
A provider's notice is a change request raised by someone else and enters the change system, not an inbox.
12 min
Incidents involving AI
Four classes by where the failure sits: wrong output at scale, an agent outside its mandate, provider failure or silent change, and data exposure through an assistant.
Triage puts the stop question before diagnosis for class B, and the stop at the identity level needs no approval.
The containment ladder runs from fallback to restore over existing state, ordered by what can be undone.
The AI Act, NIS 2, DORA and the GDPR open different clocks with different starts; a clock sheet per service is written before the first incident.
10 min
The economics: tokens, capacity, latency, energy
For an agent the unit of cost is the run, and cost per outcome is a distribution.
Every lever that reduces cost moves latency and quality, so a record says which was moved and what was measured.
A fallback is a rung with its own objective, data tier, owner and date of last use, and is treated as unavailable unless exercised.
Spend limits sit at the gateway on a credential the agent cannot widen; for a critical service the stop degrades and does not halt.
5 min
Two organisations
Hansa Mutual decides most of its model changes and needs the discipline to hold when a schedule is tight.
Nordvik Region receives most of its changes from providers and needs notice and test rights in contracts with lead times of 9 to 14 months.
What the audience takes away
Pin and record every source of behaviour change, and have the running service report which manifest produced each output.
Measure the quality of an AI service yourself, with a grader and a data path that are independent of the model and the serving platform.
Decide before the first incident who may stop an agent without approval, which clocks may open and who owns each.
Module 4 · Part IV · The Operator's Own AI · 50 minutes
The Operator's Own AI: Mandate, Observer and Tier 0
An operations agent that can restart, scale and roll back production is in effect an administrator that reads text written by other people. Part IV answers with three designs that do not depend on how the agent behaves. Authority comes from a mandate manifest enforced by a policy decision point outside the agent. Verification comes from an observer that shares neither signal, credential nor failure domain with the actor, and from a stop path outside the control plane. Defence comes from treating the agent, its credentials, its runbooks and its telemetry as Tier 0. The lecture uses Hansa Mutual's game day and near miss to show each design at work.
10 min
A team of narrow agents, not one general agent
Six roles follow the existing separations of duty: observer, triager, change reviewer, runbook runner, capacity planner and scribe; the agent that watches does not act.
Skills are versioned files and carry instruction, never authority; instructions lower the rate of unwanted behaviour, and only boundaries cap its consequences.
The mandate manifest carries authority, and the preferred path to the estate is a proposal to the desired-state repository.
8 min
Containment and promotion
A workload identity per agent, short-lived tokens issued elsewhere for a named audience, default-deny egress, rate limits and a kill switch that works when the agent platform does not.
An agent earns a level through offline evaluation, a shadow period, a seeded-fault exercise and a drilled stop, on evidence no older than 90 days.
Raising a level is a named authority's recorded decision; lowering is immediate.
14 min
The observer principle in full
Public reports from Meta, GitLab, CrowdStrike, Google Cloud and Cloudflare show verifiers, observers and notification paths that shared a fate with what they served; none involved an AI agent.
Six kinds of independence: model, data, authorship, credential, failure domain and time; a second model on the same metric gives model independence and nothing else.
The observer outside the observed: a separate failure domain, an external synthetic transaction, a dead-man's switch, and provider status as telemetry, not verdict.
Synced is not served: a state engine's report is its own view of its own work.
10 min
Defending the operator's AI as Tier 0
Six mechanisms recur, from operational text as an instruction channel to telemetry as a target; a better model solves none of them and a control outside the model bounds each.
Writer classes label text by who can write it; a summary inherits the lowest class of what it summarises, and outside text informs but does not authorise.
No standing credential for a change or restore class, signed runbooks the runner cannot edit, and a break-glass route no agent holds.
8 min
Two findings at Hansa Mutual, one at Nordvik Region
The game day of 2028-10-24 found that the remediation agent and its verification step shared a model family, an identity and a signal.
The near miss INC-HM-2029-0031: the decision point refused a restore-overwrite prompted by a ticket summary, and the review then closed the gap in the allow rules.
Nordvik Region removed the standing administrator credential that every future agent would have inherited.
What the audience takes away
Authority comes from a mandate enforced outside the agent, never from a skill, a prompt or a summary in the agent's context.
No action class moves to Level 3 Bounded without an observer that the actor cannot author, alter or share a signal with, and a drilled stop path outside the control plane.
A ceiling is a claim: state the cases tested, the date and the result, and let it expire when the policy, the model, a skill or a tool changes.
Module 5 · Part V · Operations in the Organisation · 60 minutes
Operations in the Organisation: Claims, Measures, Rights and Boundaries
Part V asks what the organisation around the loop must be able to show. The lecture's line is that every statement an operations function makes to a board, a supervisor or a customer is a claim with an owner and an age: that a service is recoverable, that a metric means what it appears to, that someone may decide, that a duty is met, that a provider can be left. For each, the part gives an artefact: the resilience register, the metric definition, the operations annex, the decision-rights file, the regulation-to-control mapping and the exit test.
12 min
Resilience as a claim
A recoverability claim has six parts: subject, scenario, objective, measured result, date and expiry; a statement lacking one is an assertion.
Status is computed, never typed: verified, expired, implemented but unverified, failed, asserted or untested, and only verified counts as recoverable.
GitLab in 2017 and Atlassian in 2022 show claims failing at a scope that was never tested.
AI plans and analyses and does not attest, and no action class rises without a verified claim behind the recovery it performs.
10 min
Measures that inform a decision, and measures that mislead
A metric is justified by the decision it informs; the four key metrics describe the change pipeline, not recovery performance.
The mean hides the tail: a 7 hour 5 minute outage moved Nordvik Region's mean time to restore by 9 minutes.
Every measure carries a gaming check, and no measure has a named person as its subject.
10 min
Operating models and the operations conductor
Each model answers a scarcity and trades something for it; the choice is made per service and recorded with exit criteria.
Four owners recur: service, objective, runbook and agent.
A managed provider is bought with six terms, a stop right and an observer outside the provider's platform; a contract right is a promise until first used.
With fewer than two evidenced conductors per window, Level 3 classes fall back to Level 2.
10 min
Decision rights on a bad night
A decision right has a holder, two deputies, a response time, an evidence standard, a record and a ceiling for AI.
The requester does not approve, the authoriser does not run, and a conflicted holder passes the decision.
Failover concurrence depends on the status of the claim in the register, and the stop right needs no approval.
10 min
Regulation as constraint
The instruments state outcomes: continuity, tested recovery, recorded and reported incidents, managed providers, competent oversight and agreed measures for staff.
They set no levels of autonomy for operations actions, so the autonomy budget is a design that makes the outcomes demonstrable, not a legal requirement.
One control serves many instruments, so the mapping starts from the control and its evidence.
8 min
Across boundaries
Concentration is a property of the dependency graph, not of the number of vendors.
Provider status is telemetry and not a verdict.
Neither DORA nor the Data Act makes an exit work; the exit test with a date, a result and an expiry is the evidence.
What the audience takes away
Say recoverable only for a verified claim, and let the register compute the status from dated, attested, independently measured tests.
Report distributions, counts beyond the objective and named lists, and define each metric by its decision, its source and its known misuse.
Write down before the incident who may declare, approve, fail over, restore and stop, and test every contract right once before relying on it.
Module 6 · Part VI · People and Career · 45 minutes
People and Career: Load, Craft and the Question of 2036
Every function of the loop ends, at some hour of the night, in a person. Part VI argues that the load on operators is a design property of the loop and not a personal failing, that responsibility must be attributed to the delegator of an agent and not to whoever stood nearest, that a craft no longer supplied by daily work must be supplied on purpose, and that whether the organisation can still operate by hand in ten years is decided now. The lecture describes people by what studies measured and gives the charter, the drill year and the horizon register as instruments.
10 min
Load is designed
The evidence is more limited than the practice built on it: availability duty is associated with changes in mood and rest, alert fatigue is documented mostly in security operations, and no independent study of operators under autonomous agents was found.
The older research on automation is firmer: practice is lost, complacency and automation bias are not cured by training, and responsibility lands on the person nearest the system.
The response is structural: a page budget and rest rule, supervision limits, a delegation record naming delegator and owner, and a stop right without penalty.
8 min
The charter is agreed first
A response-time target is a working-time parameter, and the frequency of call-outs is part of the test.
German co-determination and the Swedish duty to negotiate apply before rotas change and before a tool that logs engineers is switched on.
Metrics are about the rota and never about the person.
12 min
Keeping the craft
Five groups of competences: systems thinking, verification, manual operation, authorship and judgement under uncertainty.
The evidence on skill beside automation is long in theory and short in measurement, and none of it measures operators.
The manual-practice clause: every 90 days, agent off, an evidenced holder who did not write the runbook, every missing step recorded.
The early-career route is rebuilt with designed first rungs, an attempt-first rule and rotation.
10 min
Will anyone be on call in 2036?
A horizon register gives each trend a label, the functions concerned, evidence, a trigger and an owner.
Three futures as devices for thinking: the conductor rota, the bought loop with a verifier and the unattended estate.
The verdict: a named person answering for each Tier 1 service is expected, the form of the role is speculation, and the ability to operate by hand is decided now.
5 min
Two organisations
Hansa Mutual protects an evidence cycle against the erosion of skill by its own agent, with a quarterly dark day.
Nordvik Region protects scarce experience with an apprenticeship rotation, and its register is about whether to begin where Hansa Mutual's is about how far to go.
What the audience takes away
Treat on-call load as a property of the loop: budget the pages, protect the rest, and attribute an agent's actions to its delegator.
Keep manual operation in practice on purpose, and let a lapse in evidence lower the delegation, not the operator's standing.
Hold the organisation's view of the future as labelled trends with triggers, so that it can be shown wrong and revised.
Module 7 · Part VII · Experience and Conclusions · 50 minutes
Experience and Conclusions: What the Record Shows and What Remains Open
The last part asks whether the frame holds when it meets real failures and a real year. Public post-incident reports show changes that reached a whole population before anything independent had judged them, recovery claims that failed at a dimension never named, and observers that shared a fate with what they watched. The illustrative year of the two organisations shows honest numbers lower than the first dashboards, closure slower than any plan and no level of delegation raised, which the book counts as a result. The lecture ends with the verdicts on the five-part thesis and with what would show it wrong.
12 min
Eleven cases, read by mechanism
Four lenses: the function, the action class and its autonomy budget, the observer principle and the evidence.
Change cases, recovery cases and provider outages each show one pattern; none of the nine ordinary incidents involved an AI agent.
In the book's reading, an agent in place of the script, the rule or the pipeline would not have changed the mechanism; it would have changed the speed.
8 min
Eight anti-patterns and their controls
The green dashboard, the self-healing mask, the shared-blind-spot verifier, the unowned runbook, the god credential, the dead-man's switch that never fires, the first ring skipped and the claim at the wrong scale.
Each has a record with a re-test date and a control that earlier chapters built, outside the loop.
Nordvik Region meets the patterns of dependencies it does not own; Hansa Mutual those of running an agent and a pipeline at scale.
10 min
A year in operations
A game day caught an agent verifying itself, a refused action exposed an allow rule, a report hid an outage behind a mean, and a failover failed again before it passed.
In every case the independent observer reported something worse than the actor, and each organisation was better off for it.
Autonomy did not move, and that was a result: a verified claim, a seeded-fault result and a drill inside its target were not satisfied together.
10 min
Answers and plans for two boards
Nordvik Region: a conducted loop owned at the centre and bought under terms at the edge, with nothing at Tier 1 yet provable and dated tests to change that.
Hansa Mutual: neither rollback nor failover may be extended now; each step is earned on a stated trigger.
Five decisions go to each board, and eight indicators test the book's own claims with misuse notes.
10 min
The thesis judged
The parts are not equally strong: the observer principle and the first half of resilience as a claim rest on documented failures; the autonomy budget is the book's own proposal without outcome data.
The book's mechanisms are designs and not findings, and the two organisations are fictional.
Five things to do on Monday, each producing a written record from what an organisation already has.
What the audience takes away
Read every incident report for what the verifier, the observer and the stop path shared with the system that failed.
Expect the first honest numbers to be lower than the first dashboards, and treat a level that did not rise for lack of evidence as a result.
Hold the thesis as something that your own records of claims, tests and results can contradict.
