Over the last nine posts in this series I have looked at how Generative AI is changing different parts of an IT department: the Service Desk, Business Analysis, process analysis, Business Intelligence, Project Management, software engineering, the PMO and, most recently, Infrastructure and Operations. Taking a broad look across them together, something else starts to become apparent - the technology changes are interesting, but there is a management problem sitting above all of them.

What happens when the systems we manage stop simply recording work, displaying information and executing predefined instructions, and start interpreting situations, recommending decisions and taking actions of their own? That is the IT Management question I want to look at in Part 10.

What is it?

For most of my career, IT Management has been concerned with a reasonably familiar collection of things: people, applications, infrastructure, services, suppliers, projects, budgets, risk, security and change. These tasks still remain - AI does not remove any of those responsibilities (it changes them - but that’s for a future post).

It adds another one: delegated machine authority. Way more more dramatic sounding than it needs to be, particularly at the early stages of adoption. If Copilot summarizes an incident or drafts a project update, very little authority has actually been transferred.

But follow the maturity path and the situation changes. The AI4 Enterprise maturity model moves through Assist → Augment → Advise → Act → Automate. As the technology progresses, the intended outcomes move from faster individual work toward workflow execution and eventually operating-model change. At the same time, complexity, management effort, cost and automation increase.

That progression is visible across almost every area I have looked at in this series.

• Service Desk: We started with ticket summarization, knowledge retrieval and suggested responses. The newer generation of platforms can classify, investigate and increasingly fulfil service requests.
• Business Analysis: AI can help write and review requirements, but requirements can now also feed directly into prototypes, tests and implementation. Describing the solution is getting closer to creating the solution.
• Process Analysis: The question is no longer simply whether a process can be automated. We now have to distinguish between deterministic automation, probabilistic interpretation and agentic execution.
• Business Intelligence: We are moving from dashboards toward conversational data analysis, proactive insight and recommendations. At some point, the obvious next question is whether an insight should trigger an action.
• Project Management: AI can already summarize status and generate plans. Increasingly, agents can watch work, identify risks and coordinate portions of the response.
• Software Engineering: This has probably moved the furthest. Coding agents can work through requirements, planning, implementation, testing and pull-request preparation. Human control starts to move from individual coding activity toward review and phase gates.
• PMO: AI can do more than summarize the status that a project reports. It can independently analyse delivery evidence and challenge whether the reported status is credible watermelon project anyone).
• Infrastructure and Operations: Monitoring is becoming investigation, and investigation is starting to connect with remediation. The monitoring system may increasingly be able to fix some of what it finds.

The IT Management problem across all of these is essentially the same: What are we prepared to let the machine know, decide and do?

The software market is moving quickly in this direction. ServiceNow, Atlassian, BMC, Freshworks and ManageEngine are all moving beyond GenAI assistance into agentic service-management capabilities. Dynatrace, Datadog, Splunk and PagerDuty are doing the same in operations and observability. GitHub has coding agents. Planview is moving portfolio management toward continuous AI-supported analysis.

There is also an interesting interoperability shift happening underneath these products. Model Context Protocol (MCP), which gives AI systems a standardized way of accessing tools and context, is now appearing across a surprisingly broad range of enterprise IT products. Agent2Agent (A2A), which is intended to allow agents to communicate and delegate work to other agents, is less mature but is now appearing in platforms.

I would not make MCP or A2A a purchasing decision by themselves, but I would certainly include them in an architecture discussion now. More importantly, I would not assume something is mature because the vendor calls it an “agent” - there is still a lot of hype out there. There is quite a difference between a conversational assistant that can perform a couple of actions and an operational agent that can gather evidence, reason across it, select tools, act within defined permissions, verify the result and escalate when it encounters something unexpected.

Something we need to think about from an IT Management perspective.

What does it mean from a business perspective?

The first implication is that AI adoption starts to become an operating-model issue rather than simply a tooling issue (especially toward the right hand side of the maturity model).

• At Assist and Augment, most of the benefits are familiar productivity benefits - people search faster, write faster, analyse more material and spend less time doing repetitive work. Management is still important, particularly around security, data access, training and acceptable use, but the existing operating model generally survives.
• At Advise, things become more interesting. Imagine a PMO system that independently reviews schedules, costs, risks and delivery evidence and concludes that a project reporting green should probably be amber. Or an operations agent that examines telemetry and concludes that a known failure pattern is occurring.

The AI has not necessarily done anything yet, but it is participating in professional judgement. That raises questions about evidence, quality and accountability. What information was considered? Can someone challenge the conclusion? What happens when the human and AI disagree?

• At Act, the management problem changes again. A Service Desk agent resetting an account, a coding agent submitting a pull request and an infrastructure agent restarting a service are all “AI actions”, but the consequences are very different. And simply saying ”we have a human in the loop” may not be enough. Where is the human - before the action, after it, only when confidence falls below a threshold, only for production systems, only if the action is irreversible? The control should be based on consequence.

Useful delegation could be. For infrastructure operations, autonomous read-only investigation may provide substantial value without allowing the AI to change production. For the PMO, independently challenging project status may be valuable while automatically changing the official status may not be. For software development, allowing an agent to build and test a change may make sense while preserving human approval before merge or deployment. The appropriate boundary is different in each case.

I do not see agents replacing deterministic automation. Quite the opposite- where a task can reliably be performed by a workflow, API, script or runbook, that should generally remain the execution mechanism. The AI may interpret what is happening and decide which approved action is appropriate, but the underlying action should be predictable wherever possible.

Use probabilistic AI to interpret ambiguity. Use deterministic technology to execute predictable changes. That separation gives IT Management something much easier to govern.

What do I do with it?

Start by understanding where authority is already being delegated. Most IT departments probably have more AI capability appearing inside their existing software estate than they realise. Copilots are being added to project tools, service-management platforms, development environments, analytics platforms and observability products.

• Inventory the capability, not just the product. For each significant AI feature, establish whether it can read information, make recommendations, invoke tools or actually change something. That immediately gives a more useful picture than an inventory that simply says “ServiceNow has AI” or “GitHub has Copilot”.
• Classify AI by its authority level. A read-only incident investigator should not go through the same approval process as an agent capable of modifying network configuration. Increase the management and control requirements as the consequences of an incorrect action increase.
• Create an AI delegation register. Keep it lightweight initially. For each production agent or significant autonomous capability, record its owner, purpose, data access, allowed actions, machine identity, approval requirements, escalation conditions and logging arrangements. We already maintain inventories of applications, assets, risks and privileged accounts (I’m looking at you Internal Audit). As agents become operational, maintaining an inventory of delegated machine authority seems like a fairly natural extension.
• Keep accountability human. An agent may perform the work, but somebody should still own the outcome. “The AI did it” is not an operating model.
• Change the vendor questions. Do not ask only whether the product has GenAI or agents. Ask the vendor to demonstrate the chain from trigger through context, reasoning, authorization, action and verification. Ask what is generally available versus preview. Ask whether MCP or A2A support is native, external or roadmap. Ask what identity the agent uses and how its permissions are constrained.

Looking across the first nine articles we started by looking at what GenAI could do inside individual IT functions. What is emerging now is something larger: many of those tools are becoming capable of participating in the actual operation of IT which does not mean IT Management becomes less important.

It probably means the opposite - the role increasingly includes deciding where people should remain in control, where conventional automation is sufficient, where AI judgment adds value and where an agent can safely be given permission to act. The point is not to slow this down. There is significant value available in all of these areas.

But as we move from Assist to Augment to Advise to Act and eventually selective Automate, the management question changes. It is no longer simply: Can the AI do this? It is: Should we delegate this, under what authority, with what controls, and how will we know it worked?

That feels like a very IT Management question.