# What is AI SRE?

AI SRE agents help software engineering teams diagnose and fix production problems. They integrate with observability, incident management, deployment, code, and communication tools to build a model of the production environment. When a signal arrives - an alert, a Slack message, a metric anomaly, a regression after a deploy - the agent triages it, queries across systems, traces failures through service dependencies, and identifies root causes. Engineers review the agent's findings and decide how to act.

## Why now?

Two things changed: LLMs became capable enough to reason about complex systems, and agent frameworks made it possible for those models to take action.

LLMs can read log lines, interpret error messages, understand code changes, and form hypotheses about what went wrong. Deployed as agents - systems that plan multi-step workflows, call APIs, and maintain context across a long chain of reasoning - they can perform the same investigative work an engineer does during debugging. Production environments are a natural fit: metrics, logs, traces, deployment history, and infrastructure state are all queryable through well-defined interfaces, and the core task - gather signals, form a hypothesis, test it, narrow down - maps directly to how agents operate.

This also happens to be a problem where humans are hitting real limits. Modern distributed systems generate more signals than any engineer can process. Investigation means switching between dozens of tools, correlating events across services, and drawing on institutional knowledge that often exists only in senior engineers' heads or buried in old Slack threads. The cognitive load is growing faster than teams can hire to meet it, and every time someone leaves, their operational knowledge leaves with them.

## How it works

Most AI SRE agents integrate with monitoring, logging, APM, deployment, and communication tools. When a signal comes in, the agent starts investigating:

1. **Receive signal** - an alert, Slack message, or metric anomaly triggers the agent.
2. **Gather context** - query logs, metrics, traces, recent deployments, config changes.
3. **Form hypotheses** - generate candidate explanations based on the evidence.
4. **Test hypotheses** - run additional queries to confirm or rule out each one. Did a deploy go out? Is a dependency down? Is this a known issue?
5. **Report or act** - surface findings with evidence, or take a predefined remediation action.

The key concept is **hypothesis-driven investigation**. The agent doesn't pattern-match against known failure modes. It reasons about what could be wrong, gathers evidence, and narrows down.

## What it solves

Most AI SRE agents focus on the production work that consumes engineering time without producing engineering value.

- **Triage** - Is this signal actionable? What's the impact? Should someone wake up?
- **Initial investigation** - The first 15 minutes of an incident are usually spent gathering context. Agents do this before a human opens their laptop.
- **Cross-system correlation** - Modern architectures span dozens of services and tools. An agent queries across all of them simultaneously, faster than a human switching between browser tabs.
- **Knowledge continuity** - When an engineer leaves, their knowledge of "last time this happened, we checked X" leaves with them. An agent maintains memory across incidents.
- **On-call burden** - Agents handle routine investigation, reducing late-night pages that need immediate human attention.

## Who it's for

Software engineering teams where production work consumes meaningful engineering time. These agents help any engineer who touches production:

- **Product engineers on call** who get pulled away from feature work to investigate alerts and debug regressions.
- **Platform and infrastructure teams** carrying on-call responsibility for shared services and infrastructure.
- **Engineering managers and tech leads** looking to reduce the time their team spends on production investigation.

Most applicable to organizations running distributed systems with existing observability instrumentation. If you have metrics, logs, and traces flowing into Datadog, Grafana, or similar tools, those are the signals AI SRE agents work with.

## Limitations

- **Hallucination** - LLMs generate plausible but sometimes incorrect explanations. A wrong diagnosis during an incident makes things worse. Agents need strong grounding in real data.
- **Coverage gaps** - Agents are only as good as the tools they can access. Systems the agent can't query are blind spots.
- **Cold start** - A new agent doesn't know your architecture, your failure modes, or your team's context. Building operational memory takes time.
- **Trust calibration** - Teams need to learn when to trust an agent's findings and when to verify. Over-trusting is dangerous; under-trusting negates the value.
- **Remediation risk** - Investigation is read-only and relatively safe. Automated remediation (restarting services, rolling back deploys) carries real risk if the diagnosis is wrong. Most deployments keep humans in the loop for actions.

Companies in this space are taking different approaches. See the [landscape](https://aisre.com/landscape.md) for a map of who's building what.