Diagnose by Default, Act by Exception

An agent that operates live systems should run read-only by default and reach write actions only through review, a narrow deterministic action or a separately configured, time-bound elevated tier.

Evidence: moderate

An agent with write access to a live system can make an incident worse faster than any human. A wrong diagnosis followed by an automatic restart, config rewrite or rollback compounds the original fault, and LLM diagnosis is often wrong (see LLM SRE agent success varies by benchmark and fault class). Human approval gates set the automation level per action; the prior question is what posture the agent takes when nothing has been approved.

Products converge on read-only. The 2026 AI site reliability engineering (SRE) products give the same answer. HolmesGPT is read-only by design and respects role-based access control, with limited write actions available only through a separate remediation integration. Azure SRE Agent offers ReadOnly, Review (each action approved) and Autonomous modes, can run under a Reader identity that requests temporary elevation, and always blocks delete, remove and Key Vault commands. Datadog's Bits AI SRE runs hypothesis-driven investigations and offers human-in-the-loop triage actions. For AWS DevOps Agent, a third-party commentary argues that it deliberately diagnoses but does not act, producing mitigation plans that humans execute; that framing is opinion. A community proposal for a self-healing agent on the OpenClaw platform, a prototype of about 500 lines, states the same rules for an agent repairing agent infrastructure: diagnose before acting, never blind-restart, block dangerous commands, require approval for config changes and cap iterations.

Diagnostic tools split detect from repair. The same separation shows up one level down, in the diagnostic commands an agent calls. OpenClaw's doctor is built on a health-check contract in which each check implements a read-only detect() returning structured findings (check ID, severity, message, fix hint) and an optional repair() that runs only under --fix; after a repair, detection re-runs and warns if the finding persists, so a fix is verified by the check that raised it. Hermes's hermes doctor is read-only without --fix and exits non-zero while problems remain, which makes it usable as a gate. The trap is that the obvious unattended invocation is not always the read-only one: OpenClaw's docs (as of 2026.9.x) say plain doctor, including doctor --non-interactive, can migrate state without --fix, because the flag suppresses prompts, not writes. An agent should diagnose only through postures documented as read-only (there, --json or --lint), and treat a write posture as an exceptional, approved action. Structured findings and exit codes are also the cheap score that decides whether to wake an LLM at all (see a deterministic score gates LLM diagnosis).

Headless coding agents make a natural diagnose tier, but only with enforced confinement. The coding-agent command-line interfaces ship different defaults, and those defaults change between versions. Don't treat a missing "force" or "yes" flag as read-only. Cursor's non-interactive print mode, for example, has been documented both as proposing changes unless --force is passed and as having full write and shell access. A diagnose tier should select an explicit read-only or ask-only mode where the CLI has one, restrict tools by allow-list, and run inside a sandbox whose filesystem and network permissions enforce the read-only boundary whatever the CLI does. Check each CLI's current documentation for the version you deploy. Codex exec defaults to a read-only sandbox, with workspace-write and danger-full-access as explicit escalations. Claude Code -p supports --allowedTools rules and a dontAsk mode that denies anything that would prompt. Two loading behaviours matter. Without --bare, Claude Code's -p runs a repository's hooks and .mcp.json servers with no trust dialog, and Cursor Automations warn that memories persist across runs and advise connecting only trusted Model Context Protocol servers. Building two tiers from these defaults is an inference, not a documented product pattern: a diagnose tier that runs each CLI in an explicitly selected read-only mode, with a narrow tool allow-list, sandbox-enforced read-only permissions and machine-readable output, and a separate act tier that runs bare (no repository hooks or MCP servers), under a distinct identity, with elevation granted per action for a limited time, as Azure SRE Agent's On-Behalf-Of elevation does. Neither tier should hold long-lived credentials (see credentials stay outside the sandbox), and both sit inside the layered agent permission stack. Splitting tiers is also how such an agent drops a leg of the agents Rule of Two: the tier that reads untrusted logs holds no write power.

When a write is warranted, it should be reached through review or a narrow, deterministic action inside the prepared envelope, applied by code from the model's proposal (the LLM proposes, code applies) through a narrow action verb. In a durable runtime only the read-only diagnostics should be marked replay-safe, and any approval obtained along the way should be durable.

Sources

  • Microsoft Learn, Azure SRE Agent (modes, On-Behalf-Of elevation) — https://learn.microsoft.com/en-us/azure/sre-agent/permissions
  • Azure SRE Agent docs — https://sre.azure.com/docs/capabilities/execute-mitigations
  • CNCF Sandbox project, GitHub README — https://github.com/HolmesGPT/holmesgpt
  • Datadog blog, 5 March 2026 — https://www.datadoghq.com/blog/bits-ai-sre-deeper-reasoning/
  • Dora Noda, bex.co, 6 August 2026 (third-party commentary) — https://bex.co/blog/2026/08/06/aws-devops-agent-diagnose-not-act-line
  • OpenClaw GitHub issue #36455 — https://github.com/openclaw/openclaw/issues/36455
  • OpenClaw official docs as of 2026.9.x, retrieved 3 Oct 2026 — https://docs.openclaw.ai/cli/doctor/health-contract
  • OpenClaw official docs, retrieved 3 Oct 2026 — https://docs.openclaw.ai/cli/doctor/running
  • Nous Research official docs as of v0.21.5 (v2026.9.24), retrieved 3 Oct 2026 — https://hermes-agent.nousresearch.com/docs/reference/cli-commands
  • Cursor docs — https://cursor.com/docs/cli/headless
  • Cursor docs, cloud agents — https://cursor.com/docs/cloud-agent/automations
  • Claude Code docs — https://code.claude.com/docs/en/headless
  • OpenAI Codex docs — https://learn.chatgpt.com/docs/non-interactive-mode