Rocket Software brings governed AI agents to mainframe operations

Rocket Software is enhancing its Enterprise Virtual Assistant agentic artificial intelligence platform to investigate and potentially automate operational tasks on mainframe systems. The upcoming EVA 2.0 introduces PlanGuard, a security layer that reviews proposed actions before they are executed. This platform caters to organizations aiming to utilize generative AI in mainframe operations while preserving existing identity controls, policy enforcement, and audit trails.

EVA currently handles multistep investigations following a natural language request from a user. It identifies relevant tools and data sources, gathers operational context, correlates evidence from various systems, and presents findings, recommendations, and supporting evidence. The current focus is on analysis rather than unsupervised system modifications.

Phil Buckellew, president of Rocket’s Infrastructure Modernization Business Unit, explained that EVA streamlines complex investigations by consolidating multiple consoles, dashboards, logs, and reports into a unified, context-rich explanation of the environment and underlying reasons. PlanGuard operates as a policy decision point, examining the caller, request, session, chosen tool, environmental conditions, and organizational rules when an action is proposed.

It can approve, deny, or request further approval for the action. If granted permission, it generates a temporary execution identity limited to the approved task and then revokes it upon completion.

PlanGuard integrates with existing mainframe security managers like RACF, ACF2, and Top Secret, rather than replacing them. Customers can implement contextual and temporary authorization while retaining their mainframe controls as the underlying enforcement framework. The system maintains a tamper-evident, hash-chained audit trail that traces the agent’s reasoning and activities back to specific individuals.

This supports operational and regulatory reviews, providing a complete chain of evidence that reveals why actions occurred, using which identity, and under which policy decisions.

Rocket Software is piloting EVA with organizations in financial services, government, insurance, retail, and telecommunications. Pilot results indicate that the enhancement can significantly reduce investigation time, which typically requires multiple specialists to search disparate logs, reports, and consoles. For instance, a large South American financial institution completed a three-week production problem investigation in less than a day with EVA, while a major retailer identified a localized application-driven issue causing a CICS region outage, rather than general system contention.

EVA’s role extends beyond displaying system data. It correlates operational evidence, identifies probable causes, explains its reasoning, and assists teams in moving from understanding what happened to comprehending why it happened. This platform combines live operational information with institutional knowledge embedded in workflows, policies, tool integrations, and connected systems.

Rocket estimates that a typical deployment can yield a 3.2 times annual return on investment, including LLM expenses, through fewer specialist escalations, faster resolution of critical incidents, and 24/7 access to operational knowledge. However, the true test will be whether customers transition from AI-assisted investigation to governed execution.

PlanGuard provides policy and identity controls, but businesses must still decide which actions agents may take, when approvals are required, and how to validate conclusions before deploying changes to production.