An AI agent might pull information from one application, hand off work to another agent, and update a business record elsewhere. When something goes wrong, CIOs need to know who can follow that trail -- and whether anyone can act before the damage spreads.
In a survey of 500 qualified IT professionals at organizations implementing, testing or exploring AI observability, Omdia, a division of Informa TechTarget, found that 86% agreed their organizations had a clear strategy for implementing AI observability at scale. In a separate question, only 17% selected a mature, unified approach spanning teams, infrastructure and governance.
"I see a group of companies that understand how important AI observability is to their AI work and many have started to put elements of it in place," Mark Beccue, principal analyst for AI at Omdia, told TechTarget. "Given that only 17% have what they'd consider a mature unified approach, there's work to be done."
That contrast raises a question for CIOs: How do they know their AI observability strategy is actually working?
The money involved makes that question more pressing. Fifty-four percent of respondents estimated their organizations had allocated between $500,000 and just under $5 million specifically for AI observability over the next 12 months.
Those aren't token investments.
What can IT reconstruct?
Consider an AI agent that changes a business record after drawing on information from several systems. CIOs should be able to ask their IT and AI teams to trace what happened and explain how the agent arrived at that action.
What data did the agent use? Which tools and systems did it touch? Who was responsible for the action? And if the change was wrong, could it have been stopped before causing harm?
If three teams spend hours assembling a record of an AI transaction, the evidence may arrive after the damage has been done.
Records of an agent's instructions, the data it retrieved, the tools it used and the actions it took need to be connected across systems as the work happens. Those records might be spread among AI development, IT ops and security teams.
If three teams spend hours assembling a record of an AI transaction, the evidence may arrive after the damage has been done.
"Consolidated platforms make the most sense," Beccue said. Still, connecting observability data doesn't necessarily require collecting everything in one system. OpenTelemetry conventions for AI are being developed to help correlate traces across instrumented systems, although common standards cannot fill every visibility gap.
From monitoring to operational response
Connecting observability data and putting it to work can be challenging even in established IT environments. Mortgage lender Fannie Mae spent years consolidating infrastructure observability data to prepare for more automated, self-healing operations.
"Our ultimate goal is self-healing, but there are a lot of phases we have to go through," Nimesh Bernard, senior director of enterprise observability at Fannie Mae, told TechTarget's Beth Pariseau.
A monitoring trace by itself cannot enforce a policy or stop a transaction.
Omdia respondents identified performance and latency trade-offs, engineering integration and security, privacy or compliance costs among their leading implementation concerns. Restrictions on logging sensitive information pose another challenge for teams trying to reconstruct an agent's behavior.
"The goal is definitely to connect with operational controls," Beccue said. For consequential actions, teams may only have moments to evaluate a warning and prevent an unwanted change from reaching a business system. A monitoring trace by itself cannot enforce a policy or stop a transaction.
Human approval for every agent action would wipe out much of the autonomy enterprises expect. Automated checks are important, although they may lack the context to detect an authorized but harmful action. And their coverage has boundaries. Controlling a request before it leaves an agent does not necessarily control what happens inside the next system.
Those limitations make testing especially important. CIOs should have teams examine troublesome cases, including agents acting on incorrect information or taking unintended actions within their permissions.
"The goal here isn't to remove autonomy or require human approval for every action. It's to make sure autonomy is deliberate, bounded [and] visible," Devanshu Mehrotra, senior director and analyst at Gartner, said at the company's Enterprise Risk, Audit & Compliance Conference in September.
The real test comes when the enterprise needs to understand what an AI system is doing -- and respond while there's still time to make a difference.
In this IT Ops Query podcast, TechTarget's Beth Pariseau talks with Groundcover CEO Shahar Azulay about how AI agents are changing what organizations need to monitor and why traditional observability tools may not be enough.
James Alan Miller is a veteran technology editor and writer and Lead Editor for CIO News at Informa TechTarget. He directs coverage of enterprise technology strategy, AI, software, data, infrastructure and the decisions shaping how CIOs manage increasingly complex IT environments.