When should an AI SRE agent stop and hand off to a human?

Scope

This guide defines stop-and-transfer behavior for an AI assistant conducting production incident diagnosis. It covers analytical handoff and the boundary before an operational action. It does not grant the agent permission to remediate, declare recovery, communicate externally, or close an incident.

Why it happens

Many incident agents have a start condition but no terminal state other than “answer produced.” They keep querying when evidence is no longer improving, cross an authority boundary because a tool is available, or hand over with a prose summary that omits the queries and assumptions a human needs.

Handoff is often framed as a confidence threshold. That is fragile because model confidence may be uncalibrated and can remain high under missing telemetry. The safer design uses observable triggers across impact, evidence, authority, reversibility, budget, and time.

Diagnosis

Review a sample of incident runs and locate the first point where continued autonomy stopped being justified. Look for these trigger classes:

• Impact: affected users, safety, security, regulatory exposure, or error-budget burn crosses the approved tier.
• Evidence: required signals are missing, identities conflict, or two material hypotheses predict the observations equally well.
• Authority: actor, token, policy, approval, incident scope, or target resource is absent or expired.
• Action: the next step changes data, traffic, access, configuration, capacity, or external communication beyond the agent’s reversible allowance.
• Budget: time, query load, tokens, provider spend, or retry count reaches a predefined limit.
• Coordination: another incident, team, customer, or vendor owns a necessary decision.

If these conditions appear in historical runs but the agent continued, the problem is control design, not just prompt wording.

Solution

Encode triggers outside the model where possible. The orchestrator can compare incident severity, action class, token lifetime, query budget, and elapsed time to policy. The model may identify an evidence conflict, but the policy engine decides whether that conflict requires transfer.

Make the transition atomic: freeze new autonomous actions, save open tool calls, record current authorization, and generate a versioned transfer packet. Route it to a named role with an acknowledgement deadline. If no owner accepts, fall back to the incident escalation policy rather than resuming silently.

Evaluate the quality of handoffs. A good agent can be valuable even when it does not finish the diagnosis, provided it reduces search space without hiding uncertainty.

Artifact

Use this checklist at the transfer boundary:

Section	Required contents
Incident frame	User impact, severity, start time, scope, owner, and current service state
Trigger	Exact policy condition that caused the handoff
Evidence	Reproducible query references, signal health, and identity/time assumptions
Hypotheses	Ranked candidates, mechanism, support, counterevidence, and rejected alternatives
Observation gaps	Missing data and how each gap limits the strongest claim
Actions taken	Read queries, state changes if any, results, and idempotency references
Authority snapshot	Actor, policy version, approvals, scopes, targets, and expiry
Pending decision	What the human must decide and by when
Safe next action	One reversible, authorized step; otherwise state none
Resume condition	Evidence and new authority required before automation can continue

Common mistakes

• Using an arbitrary self-reported confidence score as the only trigger.
• Waiting until after an irreversible tool call to request confirmation.
• Handing over a polished narrative without queries, counterevidence, or observation gaps.
• Continuing because no human acknowledged the packet.
• Reusing an approval issued for a different target, action, or incident phase.