AI agents in IT service management and cloud operations

IT teams are expected to resolve more tickets, alerts and cost questions with the same headcount. AI agents in IT service management are one response: software that reads a request, gathers context from connected tools and then proposes, or takes, a defined next step. Organisations that hire AI engineers to build these agents tend to find that the technology is the smaller challenge. Deciding which steps an agent may take alone, and which need a person, is the larger one.

This article sets out where agents already help service desks and cloud operations teams, where a human must approve, and how to stage a rollout.

Where do AI agents already help the IT service desk?

Service desks handle repetitive, text-heavy work, which suits agents. Three uses are the most established.

Ticket triage. An agent reads a new ticket, assigns a category and priority, flags likely duplicates and routes it to the right queue. A person can check the result at a glance, so the cost of an error is low.

First-line answers. For common requests such as password resets or access questions, an agent can retrieve the approved knowledge article and draft a reply. This kind of IT service desk automation is only as accurate as the articles behind it, so an out-of-date knowledge base is the first thing to fix.

Incident summaries. During a major incident, updates scatter across chat, tickets and monitoring tools. An agent can compile a timeline and a plain-language summary for stakeholders, and later draft the post-incident review. These incident summaries should be read by the incident lead before they are shared.

Vendors are building to this pattern. A recent TechDay report on autonomous agents across an IT management suite describes service desk, post-incident review and knowledge article agents, with configurable guardrails and an audit trail of what each agent did.

What can agents do in cloud operations?

Cloud environments produce more signals than any team can read. Agents help most with work that is already documented or already measurable.

Runbook steps. Many responses are written down: check a service's health, collect logs, restart a failed process, scale a group. An agent can run the read-only steps automatically, present what it found and propose the corrective step. Consistent execution of documented steps is where cloud operations automation tends to deliver its most reliable gains.

Cost anomalies. An agent can watch spending, flag an unexpected rise, trace it to a service, account or recent change, and recommend an action such as removing idle resources. The analysis is useful. The decision to shut something down belongs to the owner of the workload.

Configuration drift. Environments slowly diverge from their intended state. TechDay recently covered a tool that recommends infrastructure changes and tests them before deployment. The principle is sound for any agent: propose, validate, then let people decide.

Where must a human approve?

The wider the effect of an action, and the harder it is to reverse, the more it needs a person. A practical starting rule is that an agent may read, summarise and recommend, but a named person approves anything that changes a production system.

Human approval for AI agents should be mandatory for:

• Changes to production, such as restarting customer-facing services, scaling down or deploying.
• Access and security actions, including granting privileges, disabling accounts or changing firewall rules.
• Deleting data or resources, and any action that commits spend.
• Messages to customers, regulators or executives.
• Any case where the agent reports low confidence or the request is unusual.

Every agent action should also leave a record: what it saw, what it proposed, who approved it and what happened. Give each agent the least access it needs and a named owner, so someone is accountable for its results.

How should a rollout be staged?

Caution is warranted. Gartner predicts in Gartner Predicts Over 40% of Agentic AI Projects Will Be Cancelled by End of 2027 that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls. It advises pursuing agentic AI only where it delivers clear value or return on investment.

A staged approach keeps the scope narrow while evidence builds:

1. Observe. The agent works read-only. It summarises, categorises and suggests, and people do all the work. Measure how often its suggestions are correct.
2. Assist. The agent drafts replies, tickets and runbook output. A person approves each item. Track how often reviewers change or reject its work.
3. Act on low-risk tasks. Allow the agent to execute narrow, reversible, pre-approved actions on its own, such as tagging tickets or running read-only diagnostics. Keep a clear way to switch it off.
4. Expand on evidence. Widen the scope one workflow at a time, only when accuracy, override rates and resolution times support it.

What is the bottom line?

Used this way, agentic AI for IT service management already saves time on triage, summaries, documented runbook steps and cost monitoring. Agents should not decide alone where an error is costly or hard to undo. Start read-only, add approvals where the risk is real, and widen autonomy only as the evidence earns it.

FAQ

What can AI agents do in IT service management today?

They can triage tickets, draft first-line answers from approved articles and write incident summaries. A person should review anything that affects a user or a system.

Can AI agents fix cloud incidents on their own?

For documented, low-risk steps they can. Anything that changes production should wait for human approval.

Which actions should always need a human to approve?

Production changes, access and security changes, deletions, spend commitments and external communications.

How do teams start without taking on too much risk?

Begin read-only, move to drafts that a person approves, then allow narrow, reversible actions. Expand only when measured results support it.

How should teams measure whether an agent is working?

Track triage accuracy, how often reviewers override the agent, time to resolution and cost per ticket against a pre-rollout baseline.