Root cause analysis is one of the most challenging workloads for AI agents. When an incident occurs in a production system, the natural instinct is to gather every log, metric, trace, deployment event, and configuration change, then allow the model to reason over the complete dataset. That was our approach, and it failed.

Token consumption became unpredictable, investigation latency increased, context windows were exhausted, and the agent confidently pursued incorrect root causes. What initially appeared to be a context management problem turned out to be a much deeper engineering mistake.

We were treating investigation as an act of reasoning instead of an engineered workflow.

This session explores how redesigning the investigation process changed the behaviour of our RCA agent. Rather than optimising prompts or expanding context windows, we treated investigation as an engineered workflow. The agent progressively acquired evidence, eliminated competing hypotheses, controlled its search space, and justified why one explanation was stronger than another before continuing the investigation.

Using real production failures, investigation traces, OpenTelemetry metrics, and execution telemetry, the session demonstrates how this approach produced more reliable root cause identification, fewer hallucinations, shorter investigations, and behaviour that engineering teams could understand and trust. The focus is not on providing more context to the model, but on designing investigation workflows that guide how evidence is gathered and evaluated.

What You Will Learn:

• Why providing more context can reduce the effectiveness of AI-driven root cause analysis
• How incremental evidence gathering and hypothesis refinement improve investigation workflows
• Practical lessons from production incidents using investigation traces, telemetry, and operational data

Who Should Attend:

• AI engineers
• Platform engineers
• SREs and reliability engineers
• Observability engineers
• Staff and principal engineers
• Technical leads responsible for incident response
• Teams building AI-assisted operational tooling