Before agents, there is operational context

A new question for a new phase of operations

Throughout the article series called “Modern IT Operations,” we have tried to understand how the growing complexity of technology environments has transformed the work of operations teams.

We began by discussing why so many organizations keep firefighting even after years of investment in new technologies. Next, we reflected on the paradox of monitoring practically everything and still living with a growing volume of alerts.

That discussion naturally led us to the real challenge of modern operations:

Realizing that detecting an incident is usually relatively simple, but building the context needed to identify its root cause remains one of the hardest activities in operations.

From that finding, we showed that observability stopped being just a tool and became a new way of operating, and we closed the first series by demonstrating that reducing MTTR depends far more on how quickly we understand an incident than on how quickly we carry out its recovery.

In the first article of this second series, we turned our attention to another movement that is rapidly transforming the market: the growing adoption of Artificial Intelligence agents.

The main point of that reflection was that these agents represent an important evolution, but they do not, by themselves, solve the main challenge of modern operations. We ended that article by leaving a question open.

If each agent deeply knows only one part of the operation, how will they all build a shared understanding when an incident involves applications, infrastructure, observability, networks, cloud services, and ITSM platforms at the same time?

Answering that question requires changing perspective once again.

In recent months, the market has focused much of its attention on the evolution of language models, specialized agents, and the tasks they will be able to perform. It is an extremely relevant discussion. However, there is a far more fundamental aspect that tends to stay in the background.

Before any Artificial Intelligence can interpret an incident, recommend an action, or run an automation, it needs to understand the context in which that incident is happening.

This article is precisely about that context, and about the role it will play in the next generation of IT operations.

Context is not born inside the agent

The question we closed the introduction with may seem simple, but it completely changes how we see Artificial Intelligence applied to IT operations.

If specialized agents depend on context to interpret an incident, where will that context come from?

At first glance, the answer seems obvious. Many imagine it will be built by the agent itself as it analyzes logs, queries metrics, or interprets events produced by the operation’s tools. That perception is understandable, mainly because demonstrations of AI-based solutions tend to emphasize exactly that analytical capability.

However, when we look at how operations work in complex corporate environments, we realize this expectation hardly holds up.

Imagine an organization that uses an observability platform to track applications, a monitoring tool for infrastructure, specific solutions for networks, cloud services from different providers, an ITSM system to manage incidents, plus a CMDB and a knowledge base built over the years.

Each of these platforms has a legitimate view of the operation. Each records important events. Each produces information that can be decisive during an investigation.

The problem is that none of them, alone, knows the whole story.

When an incident occurs, the relevant information exists in several places at once. A change recorded in the change management platform may explain a degradation seen by observability. A latency increase observed in applications may be related to behavior recorded by the infrastructure a few minutes earlier. A ticket opened by the Service Desk may represent only the consequence of a problem whose origin is in a completely different component.

These relationships rarely appear explicitly in a single tool.

In practice, they need to be built.

That is exactly the work the most experienced operations professionals do today. When investigating an incident, they do not analyze only metrics, logs, or tickets. They try to relate information from different platforms, reconstructing a logical sequence of events until the environment’s behavior starts to make sense.

That activity requires much more than interpretation capability. It requires context.

Notice that this finding changes how we should understand the role of Artificial Intelligence agents.

They do not start their analysis from a complete view of the operation. They start from the information made available to them.

The better that set of information is, the greater the likelihood they will produce consistent analyses. Likewise, when that context is incomplete, fragmented, or spread across different platforms with no explicit relationship between them, even extremely sophisticated agents will struggle to reach the best conclusions.

That is why perhaps the most important question is no longer “how intelligent is the agent?” Perhaps we should ask “how complete is the context it received to work with?”

The difference between information and context

This distinction seems like a matter of terminology, but it has deep consequences for the architecture of IT operations.

For many years, we invested to increase our capacity to produce information. We instrumented applications, expanded metric collection, centralized logs, deployed observability platforms, and created increasingly sophisticated mechanisms to record the behavior of environments.

Today, few organizations suffer from a lack of data, but the challenge has changed.

We now live with an enormous amount of information spread across dozens of platforms, each organized according to its own logic, its own identifiers, and its own view of operational reality.

Information, therefore, is no longer a scarce resource. The truly scarce resource became the ability to connect that information coherently. That connection is what turns information into context.

Consider, for example, a degradation noticed by users of an e-commerce system. In isolation, an increase in CPU usage, a recent change to an authentication service, growth in API response time, and a rise in the number of tickets logged by the Service Desk are just independent pieces of information. Each describes one aspect of the environment.

When we manage to establish the relationships among these events, identifying their time sequence, their dependencies, and their impact on the business, we stop observing a set of disconnected symptoms and start understanding a single incident.

This transformation does not happen because new data appeared. It happens because the existing data started to make sense when observed together.

That is exactly the kind of understanding any Artificial Intelligence agent will need to receive to produce truly useful analyses in modern operations.

Context is built, not found

An idea appears often when we discuss Artificial Intelligence applied to IT operations. Many imagine that operational context already exists and that it is enough to let an agent query it to get better answers.

In practice, modern operations work quite differently. Context is rarely ready.

In most organizations, it needs to be built continuously from information produced by dozens of independent platforms, each recording only part of the environment’s behavior. Infrastructure metrics, application logs, distributed traces, security events, changes recorded in change management, Service Desk tickets, CMDB information, network topologies, dependencies between services, and business indicators coexist, but they usually remain stored in separate repositories and organized according to completely different models.

Individually, each of these sources describes only a small portion of operational reality.

Context emerges when this information is related. That distinction may seem subtle, but it completely changes how we should think about the architecture of operations.

Consider a company that has just received hundreds of alerts indicating degradation in different critical applications. An agent specialized in observability may identify significant changes in response times. Another agent, responsible for infrastructure, will notice a significant increase in the use of certain computing resources. A third will find error records in authentication logs. At the same time, the ITSM will show a sudden growth in the number of tickets, while the change platform will record an update made a few minutes before the degradation began.

None of this information explains the incident on its own. The explanation begins to emerge when we can establish the relationships among them.

That is the moment when data stops representing only independent events and starts forming a coherent narrative about the operation’s behavior.

Notice that this narrative was not stored in any specific tool. In fact, it had to be built.

That construction process is what turns a set of scattered information into operational knowledge capable of supporting decisions.

This characteristic deeply differentiates IT operations from other scenarios in which Artificial Intelligence models are also being applied.

Operations do not work only with documents. They work with relationships.

When we think about traditional AI applications, it is common to imagine an agent querying documents, internal policies, technical manuals, or knowledge bases to answer specific questions. In those cases, the quality of the answers depends largely on the ability to retrieve the most relevant documents and use them while generating the response.

In IT operations, however, the challenge is usually different.

The incident the team is trying to understand is usually not described anywhere. It is happening at that very moment.

More than retrieving existing information, the operation needs to reconstruct a sequence of events that is still unfolding. That requires correlating events produced at different moments, understanding dependencies between components, identifying cause-and-effect relationships, and distinguishing symptoms from what actually gave rise to the problem.

In other words, the knowledge that will guide the decision does not yet exist explicitly. It needs to be produced.

This may be one of the most important differences between using Artificial Intelligence to answer questions about a document base and using it to support critical operations in real time. In the first case, the main challenge is correctly retrieving information that is already organized. In the second, the challenge becomes continuously building an operational context capable of representing the environment’s dynamic reality.

That is precisely why context cannot be treated as an architectural detail.

It becomes the very infrastructure on which agents, operators, and Artificial Intelligence models can build a shared understanding of the incident.

Context becomes the infrastructure of Artificial Intelligence

Over the past few years, we have grown accustomed to thinking of IT operations as a set of specialized tools. Each platform came to play a specific role, observing part of the infrastructure, applications, or business services. That evolution brought important gains in visibility, automation, and analytical capability, but it also made a new challenge clear: understanding distributed environments requires much more than analyzing information produced by isolated systems.

The arrival of Artificial Intelligence agents does not change that reality. On the contrary, it makes it even more evident.

The more capable these agents become of interpreting information and supporting decisions, the more important the context made available to them becomes. After all, the quality of their conclusions will remain directly tied to the quality of the understanding they can build about the operational environment.

That is exactly why context should not be seen as a complementary resource of Artificial Intelligence. It becomes a new layer of the architecture of modern operations.

That layer is responsible for integrating information from different platforms, establishing relationships between events, preserving dependencies between services, and offering a coherent representation of operational reality. It is on this layer that operators, specialists, and Artificial Intelligence agents build their analyses, formulate hypotheses, and make decisions.

When we look at the recent evolution of operations from this perspective, we see that the discussion stops being technological and becomes architectural.

The most important question is no longer how many agents an organization will be able to develop or buy.

The question becomes a different one.

How do we ensure that all of them work on the same understanding of the operation?

This change of focus deeply alters how we should plan the future of IT operations. Instead of imagining a set of independent intelligences competing to interpret the same incident, we begin to envision an environment in which different agents collaborate because they share a common base of knowledge about what is happening.

This may be the main transformation we will see in the coming years.

Not an evolution based only on ever more sophisticated models, but on the ability to build and maintain a shared operational context rich enough to let people and Artificial Intelligences work on the same reality. As autonomy advances, another complementary question is who will operate AI agents in production.

The next challenge

If operational context takes this central position in the architecture of operations, a new question naturally arises.

So far, we have discussed why specialized agents depend on that context to produce consistent analyses, and we have shown that it does not arise spontaneously inside Artificial Intelligence models. We have also seen that this context needs to be built continuously from the integration and correlation of information from multiple sources.

What remains is to understand how this happens in practice.

How do we turn data distributed across independent platforms into a single, coherent representation of the operation? How do we preserve the relationships among applications, infrastructure, services, changes, and business processes so that different agents can work on the same understanding of the environment?

These questions lead us to the next step in this series.

In the next article, we will discuss why a specialist agent knows one tool deeply but remains unable to understand on its own an incident that crosses the entire architecture. We will see that specialization, although indispensable, does not eliminate the need for a cross-cutting view of the operation. On the contrary, the greater the number of specialists, human or artificial, the greater the importance of a shared operational context that connects all these perspectives.

About the author

Paulo Florêncio de Menezes is an entrepreneur, partner, and co-founder of companies such as Target Solutions, BiPTT, and ARGUS.

He holds a degree in Data Processing from the Federal University of Amazonas (UFAM), an MBA in Business Management from Fundação Dom Cabral (FDC), and a Professional Master’s in Economics from Fundação Getulio Vargas (FGV).

In his Master’s research, he developed the IBEOP-IA (Brazilian Index of Potential Occupational Exposure to Artificial Intelligence), investigating the potential exposure of Brazilian occupations to AI capabilities by combining occupational data, artificial intelligence patents, and natural language processing techniques.