Topic starter
18/08/2026 2:31 pm
TL;DR: Developers can investigate production incidents from the same AI interface they already use, as coding agents search logs, traces, metrics, events, and monitors through edx, according to Edge Delta. The security implication is that telemetry access, command execution, and API token handling now sit inside agent workflows, so governance must treat the agent as an operational identity.
Editorial analysis by NHI Mgmt Group, based on content published by Edge Delta: “Investigate Production Incidents Within Your AI Coding Tools with Edge Delta”.
Key questions
Q: What is the main governance risk when coding agents investigate production telemetry?
A: The main risk is that a seemingly read-only investigation workflow becomes a delegated operational identity with access to logs, traces, metrics and potentially remediation paths.
Q: Why do agent-led telemetry workflows increase identity and access risk?
A: They increase risk because the agent often authenticates through reusable credentials that can outlive the immediate investigation.
Q: What breaks when a single agent session can both investigate and influence remediation?
A: The separation between diagnosis and change control breaks down.
Practitioner guidance
- Define separate read and write scopes for agent workflows Limit telemetry agents to query-only access unless a specific remediation task is approved.
- Use short-lived authentication for interactive agent sessions Prefer OAuth-backed sessions for human-led investigations and avoid long-lived API tokens where possible.
- Audit the edx command surface before broad rollout Review which edx commands the installed skills can call, then disable or restrict anything that exceeds investigation needs.
Bottom line: Coding agents that investigate production telemetry are no longer passive assistants. They operate as delegated identities that can query sensitive systems and shape incident response.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:18 pm
Agentic observability creates a new identity problem, not just a usability gain. Once a coding agent can investigate logs, traces and monitors, the control question becomes who or what is authorised to reason over production telemetry. That is a classic NHI governance issue because the agent is operating as a software identity with delegated reach into operational systems. Practitioners should treat telemetry investigation as a governed identity workflow, not a convenience feature.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat coding agents as NHI in observability workflows?
A: Yes. If the agent authenticates to telemetry systems, executes commands and persists across tasks or pipelines, it functions as a non-human identity with delegated authority. That means inventory, scope, rotation, revocation and logging should be managed as NHI controls, not left to ad hoc developer tooling practices.
👉 Read our full editorial: Agent skills for telemetry investigation change incident response