How AI agents are changing on-call rotations

The On-Call Page Tree Just Grew an Agent at the Top

For fifteen years the on-call page tree has had the same shape. An alert fires. A primary gets paged. If the primary does not ack inside the SLA window, the page escalates to a secondary. If the secondary does not ack, the page escalates to a manager. Somewhere down the tree a human picks up the phone, reads three dashboards, and starts typing into a runbook.

That tree changed in 2026. PagerDuty’s Spring 2026 release put an SRE Agent directly on escalation policies and on-call schedules. AWS shipped its DevOps Agent into general availability for autonomous incident investigation. Gartner’s Predicts 2026 puts agentic IT operations at less than five percent of enterprise deployments today and at seventy percent by 2029. The page tree now has an agent at the top, and the human escalation tier sits below it.

That sounds like marketing. It is not. The on-call rotation as it has been practiced since the early 2010s is changing materially, and the platform teams that figure out the new shape first will run smaller rotations with better outcomes than the ones that keep the human-first model.

What “Agent at the Top” Actually Means

An agent-first page tree is not “the same page tree with a chatbot in front of it.” The structural change is that the first responder is software, the human becomes the second responder, and the criteria for human escalation are explicit and policy-governed.

Concretely, the page flow becomes:

1. Alert fires. Same signal sources as before — Datadog, Prometheus, CloudWatch, custom probes — feeding into a paging platform.
2. Agent activates within seconds. It has read access to the affected services, the deploy timeline, the configuration history, the relevant runbooks, and the incident graph. It runs an investigation in parallel with what a human would do, but in tens of seconds rather than tens of minutes.
3. Agent classifies. Reversible-and-in-policy → execute remediation, log the action, mark the incident resolved if the metric returns to baseline. Reversible-but-material → propose remediation, gate on human approval, execute on confirmation. Irreversible or out-of-policy → escalate immediately to the human responder with full context.
4. Human enters the loop where the agent gates. Approver, not first responder. The human’s first action is reviewing what the agent has already established, not opening a fresh laptop.
5. Post-incident. Agent drafts the timeline, the human edits it, the audit trail is the artifact.

The shape change is the third and fourth steps. The agent is not waiting for the human to investigate; it is investigating, and only escalating where investigation alone is not enough.

See the IAN team run on your cloud. We connect to your AWS account via a scoped read-only role, run the Observe-tier agents, and leave you with a concrete audit report — cost waste, security exposure, compliance gaps, and a labor-offset estimate. You keep the findings regardless of next steps. Get a free infrastructure audit →

What Has to Be True for the Pattern to Work

Three preconditions sort the teams that can run an agent-first rotation from the ones that cannot.

Capability-tier governance on the agent. An agent that can take action without an approval gate on irreversible work is a liability, not a responder. The pattern that holds in production is the Observe / Operate / Administer split: Observe tier reads, Operate tier acts on reversible in-policy work autonomously, Administer always escalates to a human. The PagerDuty SRE Agent, the AWS DevOps Agent, and the agent-side of incident.io and Grafana OnCall all converge on this model in 2026 — the language differs, the structure does not.

Immutable audit trail on every action. Every read, every action, every approval, every escalation gets an entry. Tamper-evident chain. SOC 2 CC7 / CC8 controls map cleanly onto this; FedRAMP IR-4 maps onto it; HIPAA §164.308(a)(6) maps onto it. The audit trail is what the security and compliance functions need to bless agent-first paging at all.

Runbook-as-context, not runbook-as-PDF. The agent needs structured runbooks the same way a human responder needs structured runbooks: pre-condition, diagnostic steps, remediation steps, rollback procedure, escalation criteria. Teams whose runbooks are PDFs in a wiki cannot use them as agent context without converting first. Teams whose runbooks are markdown in the same repo as their service definitions are halfway to agent-first paging already.

What Stays Human

The wrong frame on agentic incident response is “the agent replaces the on-call.” The right frame is “the agent removes the easy half of the on-call.” The half that stays human:

• First time a class of incident is seen. New patterns require human classification before the agent’s runbook trust extends to them.
• Customer-facing communications. The agent can draft; the human sends. The legal and brand surface is not something to automate.
• Decisions about post-incident process change. The agent surfaces the pattern; the human decides what changes structurally.
• Anything where the agent’s blast-radius estimate is “unknown.” Conservative gating is the design principle. If the estimator cannot bound the impact, the human gets the page.
• Cross-organizational coordination. Incidents that span teams, vendors, or customer contracts are coordination problems, not investigation problems.

The shape of the post-2026 on-call rotation: smaller rotations, fewer pages per rotation, more time spent on the high-judgment incidents that justify the rotation existing. The pages that used to wake people up at three AM for a known-pattern OOM kill are absorbed by the agent.

How the Tools Are Shaping Up

Five 2026 patterns to track:

PagerDuty. SRE Agent in early access through Q2 2026, full autonomous capabilities targeted for the second half of the year. Strategic partnerships with Anthropic, Cursor, and LangChain published as a multi-agent operational fabric over Model Context Protocol. The bet is that PagerDuty becomes the coordination plane for an ecosystem of agents rather than building all the agents itself.

AWS. DevOps Agent went GA in April 2026 for incident investigation across AWS services. Strong inside an AWS-only environment; structurally locked to AWS, which is the same constraint AWS Q Developer has and that hyperscaler copilots will continue to have through this generation.

incident.io. Continuing the human-and-agent collaboration model with Slack-native incident channels and a lighter-weight automation surface. Strong fit for teams whose primary operational surface is already Slack.

Grafana OnCall. Open-source positioning, plays well with the Grafana stack. Lighter on the autonomous-agent side as of mid-2026 but converging.

The active operational layer (where IAN sits). Cross-cloud, MCP-first, agent-as-first-responder with capability tiers and audit trail. Distinguishes itself by covering the full operational surface — cost, security, deployment, resource ops — not just incident response. The on-call rotation becomes one of several agent-handled surfaces, not a separate product.

The Three-Phase Rollout

For a platform team adopting an agent-first rotation, the working sequence is:

Phase 1 — Observe-tier shadow. Agent runs alongside the human on-call for thirty to ninety days. Logs every investigation, every classification, every recommendation. No autonomous action. Goal is calibrating the agent against ground truth before you trust it. Trust comes from evidence, not from the vendor.

Phase 2 — Operate-tier on reversible classes. Once shadow runs converge, enable autonomous remediation on a small, well-bounded set of reversible action classes — restarting a stuck pod, rolling back a deploy with a known-good previous version, scaling out a saturated service. Approval gate stays on everything else. Measure mean-time-to-resolution before and after; the win shows up in the long tail of three AM pages that the human used to handle in twenty minutes and the agent handles in two.

Phase 3 — Administer-tier always gated. IAM changes, billing-affecting changes, schema changes, anything irreversible. Always escalates to a human approver, separation-of-duties enforced. This tier never becomes autonomous; the work is to make sure the agent is good at presenting the context the human approver needs to make a fast and correct decision.

The three phases are not a year-long project. The first phase is two to four weeks for a team with structured runbooks. The second phase is another four to eight weeks. The third phase is steady-state. Teams that try to skip phase one and go straight to autonomous remediation are the ones who write the post-mortem about why they had to roll the agent back.

What the Rotation Looks Like When It Works

The headline metric most teams chase is mean-time-to-resolution, and it does come down — fifty percent reduction is the figure PagerDuty cites for early SRE Agent adopters and matches what teams report in private. But the more important metric is the one that does not show up on the public benchmark: the count of pages that wake a human up.

A working agent-first rotation has the human on-call awake for the incidents where judgment matters and asleep for the ones where the runbook had a definitive answer. The platform-team retention impact of that shift is large. The capacity impact is large. The compliance-and-audit impact is positive. And the cost impact — measured against the labor-replacement frame — is what makes the rotation worth running this way at all.

The teams running this pattern in 2026 are not the ones making the most noise about it. They are the ones whose on-call rotations got smaller and quieter, whose post-incident reviews got faster, and whose platform engineers stopped quitting over the page burden.

How IAN Helps

IAN’s incident / SRE agent runs the agent-at-the-top-of-the-page-tree pattern on the active operational layer. It investigates within seconds of the alert firing, classifies under Observe / Operate / Administer with capability-tier governance, executes reversible in-policy remediation autonomously, and escalates to the human on-call only where judgment is required. Every action is appended to an immutable audit trail; every approval is logged with separation-of-duties on Administer-tier work.

Because IAN is MCP-first, the on-call surface is the same surface engineers already work in — Claude, Claude Code, Cursor, or any MCP-compatible client. There is no new dashboard to learn. The agent shows up where the responder already is, with the context already gathered, and the audit trail already written.

Pricing is BYOK. Customers bring their own Claude or model keys; IAN charges for the orchestration layer, scoped to per-account and per-action volume. The on-call rotation’s economic story becomes the same as the platform team’s economic story — orchestration cost is small and predictable, inference cost is metered against the customer’s existing model contract, and the labor offset is the line item that pays for the rest.

Get a free infrastructure audit → | See pricing →