Matt Aiken of IBM Technology uses a hypothetical banking transaction to explain how an operations agent can combine documented knowledge with current evidence.
Two kinds of context
- Retrieval-augmented generation (RAG) brings relevant runbooks, architecture and prior tickets into the agent’s response: how the system is supposed to work.
- Observability supplies current metrics, logs, traces, topology and change events: what the system is doing now.
- More telemetry alone can add noise; select relevant signals and connect them to the affected service.
A slow balance inquiry
- A mobile request crosses an API, a queue and a mainframe, potentially spanning teams and tools.
- In Aiken’s example, a trace shows a slow middleware call, a queue grows, logs show timeouts and a configuration change preceded the slowdown.
- Together these signals suggest where to investigate; their timing does not establish root cause.
- RAG can identify the intended transaction path and applicable checks; telemetry ties the investigation to the present incident.
Organize the response for an operator
- Evidence: identify changed signals and the logs, metrics and traces supporting them.
- Impact: identify dependent applications, services and workflows across system boundaries.
- Next steps: check the configuration and queue, compare a baseline, or involve the owning team.
- A human validates evidence, assesses impact and decides what action to take; telemetry may be incomplete and correlations may be coincidental.
“None of these facts alone prove root cause.”
This is an illustrative architecture and investigation, not a measured evaluation of an agent or a demonstration that the workflow reliably diagnoses incidents.