What it takes to trust AI with real-world fixes
Microsoft describes how it built an AI agent to diagnose and fix production network incidents autonomously, emphasizing that safety depends on layered controls rather than smarter models.
Microsoft developed an AI agent capable of diagnosing production network incidents by pulling device state, reading telemetry, and writing incident summaries before engineers log in. The system can also identify fixes, raising the question of whether it should be allowed to execute actions like shutting a BGP session carrying live customer traffic. The company argues that enabling such actions requires more than just a smarter model or stricter prompts; it demands a layered, deterministic safety stack around the model.
The agent is not the model itself but the deterministic software that governs how the model is used, including what tools it can access and what actions it may take. Microsoft frames the safety challenge as one of authorization and control rather than intelligence, noting that models are already adept at identifying fixes but struggle with defining permissible actions. The company’s solution involves wrapping the model in a mostly-deterministic workflow with narrow, schema-checked steps to ensure consistent behavior.
Microsoft’s architecture for safe agentic AI consists of four layered boundaries: identity, tool access, mutation control, and time-based reliance. Identity ensures the agent acts only under the human’s permissions, while tool access restricts interactions to controlled interfaces. Mutation control pauses the agent before any production changes, and time-based reliance reduces live reasoning as the agent gains experience. The company emphasizes that no single layer is sufficient alone, highlighting defense in depth as essential.
The agent never operates with its own powerful account but instead acts on behalf of the invoking human, with access policies defined per tool and managed through pull requests. Every tool interaction is structured, logged, and individually authorized, with raw shells avoided in favor of typed interfaces. Microsoft argues that while command lines can be secured, per-tool granularity and least-privilege access are better achieved through interfaces like MCP, which provide credential isolation, audit trails, and human approval hooks.