Notifications
Clear all
Topic starter
18/08/2026 2:31 pm
TL;DR: Developers can investigate production incidents from the same AI interface they already use, as coding agents search logs, traces, metrics, events, and monitors through edx, according to Edge Delta. The security implication is that telemetry access, command execution, and API token handling now sit inside agent workflows, so governance must treat the agent as an operational identity.
NHIMG editorial — based on content published by Edge Delta: Agent Skills for AI-driven telemetry investigation
Questions worth separating out
Q: What breaks when AI agents can investigate and remediate production from one session?
A: The main failure is the collapse of inspection and control into a single privileged workflow.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What do security teams get wrong about agentic AI security tools?
A: The most common mistake is treating agentic AI security as an extension of an existing category such as NHI, endpoint, or DSPM.
Practitioner guidance
- Classify agent sessions as governed NHIs Assign each AI coding agent access policy, ownership, and revocation criteria just as you would for service accounts and automation credentials.
- Separate investigation from remediation permissions Allow read-only telemetry search by default, then gate monitor edits, pipeline changes, and config actions behind a separate approval path.
- Rotate and scope API tokens for edx usage Bind tokens to specific orgs and use cases, limit lifetime, and revoke credentials when the agent workflow or environment changes.
What's in the full article
Edge Delta's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step edx installation and authentication commands for interactive and CI use.
- Exact Agent Skills modules such as ed-logs, ed-traces, ed-monitors, and ed-investigate.
- The full incident walkthrough showing the memory leak pattern, OOMKill sequence, and rollback-ready fix location.
- How the SKILL.md modules map to Claude Code, Cursor, and Copilot in real environments.
👉 Read Edge Delta's guide to Agent Skills for AI-driven telemetry investigation →
Agent skills for telemetry investigation: are your controls ready?
Explore further
18/08/2026 3:18 pm
Agentic observability creates a new NHI class that sits between developer tooling and operational control. Once an AI coding agent can search logs, inspect traces, and invoke remediation workflows, it is no longer just a user interface. It becomes a delegated operational identity with access expectations, lifecycle requirements, and abuse paths that IAM teams cannot ignore. Practitioners should classify these agents as governed NHIs, not as harmless productivity wrappers.
A question worth separating out:
Q: How should organisations govern agentic AI in observability workflows?
A: Treat AI as a bounded operator, not an all-purpose controller. Give it narrow permissions, require audit trails, and restrict it to approved actions such as validation, suggestion, or rollback of pre-defined changes. If the telemetry path is fragmented, fix that first, because agentic automation amplifies whatever control model already exists.
👉 Read our full editorial: Agent skills for telemetry investigation change incident response
