Agentic DevOps Twelve Months In — Which Hypotheses *Survived*, Which Didn't

Twelve months ago I published The Next Decade of DevOps Is Agentic. It put down five hypotheses. Twelve months of data have confirmed three, partially negated one, and abandoned one. Honest evaluation.

Hypothesis 1 — agents move time, they don't replace people

Confirmed ✓. Twelve months across 11 customers:

• First-line triage time 60 min → 8 min (−87%)
• Repetitive ops time automated 24/7
• Investigation time 35 min → 9 min (−74%)

Zero roles eliminated. Human time clearly migrated to design / policy / supervision. Hypothesis held.

Hypothesis 2 — the permission model matters more than model choice

Confirmed ✓. Four variables (decision/execution split, conditional permissions, same audit schema, deterministic wrapping) predicted adoption viability across seven customers. → Can agents hold production deploy authority

Every passing case — those four variables met from the start. Hypothesis held.

Hypothesis 3 — multi-agent is almost never necessary

Confirmed ✓. Five cases tried, all five fell back to single-agent. → Multi-agent is almost never the answer

Held. We did learn that rare exceptions (physical isolation, temporal separation, genuinely different model capabilities) exist.

Hypothesis 4 — agents' real value = time savings (partially negated)

Partially negated ⚠. Time savings are real — but not the most important value.

Unexpected value seen across 12 months:

1. Incident knowledge preservation — even when people leave, agent traces preserve incident-response patterns
2. Reduced burnout-prone job duties — overnight first-line triage gets shifted off humans. Indirect retention effect
3. Faster onboarding — while the agent triages, new SREs learn alongside it

These three are quietly larger values than time savings. We didn't anticipate them. Partially negated — the hypothesis isn't wrong, it was too narrow.

Hypothesis 5 — ChatGPT-tier models are sufficient (abandoned)

Abandoned ✗. Original assumption — GPT-4 / Claude Sonnet tier is enough. Reality — the plumbing (context + tools + permissions + audit) matters more than model capability. Sonnet is sufficient as a model, but no model works without good plumbing.

Abandoned — the model itself isn't the core. The system around it is. The hypothesis needs reframing.

New hypotheses for the next 12 months

Five new hypotheses, informed by what we learned:

1. Agent retention / onboarding effects, when measured, reshape the cost-benefit model
2. Authority-boundary expansion pace — by quarter, one step further on what agents can hold
3. Multi-agent still almost unnecessary — to be re-validated for another 12 months
4. RAG > fine-tune as the general pattern across all domains
5. Plumbing standardization — does MCP become an industry standard like supply-chain security did

Will re-evaluate these twelve months from now.

Twelve months in one line

Hypotheses being correct isn't the win. Hypotheses being measurable is.

All five above were measurable. So correct / wrong / partial came back as clear answers. Unmeasurable hypotheses never get validated. The first value is putting down hypotheses that can be measured.

The next field report comes in twelve months

This post is the follow-up for anyone who read The Next Decade of DevOps Is Agentic twelve months ago. The outcome of the original five hypotheses is above; the next five get validated and published the same way, twelve months from now. If you're an SRE, platform, or security lead who wants honest field reports on agentic DevOps, see you then.