The Three Tiers of Agentic Incident Response: When to Trust AI Autonomy

The article discusses the concept of "tiered autonomy" in the context of AI agents assisting in incident response for tech systems. It argues that rather than fully automating all incident response, AI agents should operate within three distinct tiers based on the severity and complexity of the incident.

Tier 1 represents fully autonomous remediation for well-understood, reversible incidents. These are cases where the failure pattern matches a proven runbook, the blast radius is limited to a single workload or component, and the action can be quickly and safely reversed. Examples include restarting a stateless pod, rolling back a payment deployment, or responding to credential compromise. The AI agent conducts its analysis, executes the remedy, verifies success through telemetry, and posts a concise incident record.

Tier 2 allows the AI agent to investigate the situation, recommend actions, but requires explicit human approval before any changes are made. This tier covers moderate-risk incidents with a wider blast radius, such as scaling out a service during a predictable traffic spike. The agent collects relevant evidence, formulates a hypothesis, and the human SRE reviews and authorizes the action.

Tier 3 keeps humans in complete command for novel, complex or high-impact incidents where the AI lacks sufficient evidence or confidence in its diagnosis. Security breaches, multi-service failures and incidents with ambiguous signals would fall into this tier. The AI agent accelerates evidence collection and hypothesis testing, but the final decision and command authority rests with a human SRE.

The key factors considered before assigning an incident to a tier are:

1. Familiarity and precedent of the failure pattern

2. The maximum plausible blast radius if the diagnosis or action is incorrect

3. Whether the action can be quickly and safely reversed

4. The agent's decision being supported by sufficient evidence

The article emphasizes that tiered autonomy makes automation more trustworthy by making it earned, bounded, observable and reversible. By matching the AI agent's permissions to the incident characteristics, organizations can balance rapid remediation with appropriate human oversight, ultimately reducing mean time to recovery while avoiding over-reliance on autonomous systems.