What AI Incident Response Leaves Behind

What does a missed Uber tell us about the future of incident response?

A couple of weeks ago, I flew to Seattle for SREcon ‘26. I landed at around 8pm local time, while my UK body clock screamed 3 AM. My first mission was to catch an Uber to the hotel, but standing in the signposted “designated ride-app area” on the third floor of the airport parking garage, the Uber app and I disagreed about where I was.

This was a problem, as taxis fundamentally depend on a consensus between the driver and passenger location. Therein commenced my unexpected side-mission to navigate myself to where Uber “thought” I was.

This was an alien experience: navigating in foreign surroundings, fatigued, under time pressure, to catch an Uber which under normal circumstances would have been a matter of pressing a button and waiting. This unfamiliar experience involved asking fellow humans for directions (I kid you not), and a confusing encounter with the realisation that maps don’t represent building-stories (floor 3/2/1 of the parking garage) nearly as well as longitude and latitude.

So I missed my Uber, but gained a relatable real-world encounter with the Left-Over Principle.

The Left-Over Principle

While the Seattle Uber experience is likely uniquely mine, you’ve almost certainly experienced the Left-Over Principle while driving. Finding-your-way is now a solved problem thanks to sat-nav, but many of you will have experienced a feeling of utter helplessness when the reality of your surroundings fails to match the confident assertions of the GPS. These moments (frequently caused by surprise diversions, incidents etc) force us to relinquish our passive surrender of cognition to technology, and to reanimate expertise that has long since withered away due to disuse. Read a map? Observe road signs? What is this, the 1800s?

Uber and sat-nav are examples of automation, and the Left-Over Principle refers to tasks that remain when an automation has automated as much as it can. Remaining tasks tend to be either/ or :-

1. Too simple and unobtrusive to bother automating – where the cost of automating is higher than the repeated cost of the task
2. Too difficult to automate – where the task is rare, especially complex or completely novel

The principle is most commonly associated Lisanne Bainbridge’s 1983 paper Ironies of Automation though the name itself comes from the Joint Cognitive Systems literature. Tasks that are too difficult to automate naturally fall to people to solve, and require substantial expertise. This human expertise may be missing however, due to a paucity of opportunities to develop it on simpler tasks that have been automated away.

This creates a paradox of sorts, where increased automation drives a need for greater human expertise to deal with leftover tasks, while simultaneously reducing the opportunity to develop it. In Bainbridge’s words:

…the increased interest in human factors among engineers reflects the irony that the more advanced a control system is, so the more crucial may be the contribution of the human operator.

The leftovers of automated incident response

The motivation to automate incident response is strong and entirely relatable. Few people enjoy holding a hot pager (though they do exist), and fewer still enjoy it going off at 3 AM. The dream of being able to ‘Sleep through on-call’ (as one AI SRE vendor advertises) is a pleasant one. The revolution of AI-assisted development and the hype of AI Ops tooling has given credence to the argument that incident response may soon be a ‘solved problem’ in the same way that some folks believe about development.

Whatever one’s belief, the path from not-automated to fully-automated is far from straightforward, due to (amongst other things) the Left-Over Principle.

In February ‘26, London’s OOPS (Outage Operations) Meetup group hosted an evening discussing AI in incident response. The prevailing option amongst practitioners in the room was that LLM based tooling (home-grown or commercial) is starting to show promise in addressing the ‘low hanging fruit’ of incident response. Examples include: auto summarisation of incident chat transcripts, causal diagnosis, intervention suggestion and even remedial pull requests, with encouraging but mixed results.

Implicit in the ‘low hanging fruit’ theory is the assumption (hope?) that technology will grow to reach higher, juicier, more complex and eventually, all fruit.

Unfortunately, until that moment arrives, each advance in AI incident response will render increasingly complex scenarios ‘Left-Over’ to human intelligence, which itself will be less and less prepared to deal with them.

How are you planning to address this conundrum?

behold the horror of my remaining drawing skills when I was unable to generate a convincing low-hanging fruit image with nano banana.

The Challenge Of Incident Response in the New Reality

I’d like to conclude this short post by offering a few hopefully uncontroversial statements about our current reality in technology, followed by a question.

1. AI-assisted development is increasing (and will continue to increase) the rate at which software is created (irrespective of its value).
2. Such software will be of generally greater complexity than that created in the past.
3. Humans will have relatively less tacit knowledge about how it works, compared to pre-AI created software.

If any, let alone all three of these statements are true, what might be the effect on the volume, frequency and complexity of software related incidents?

If any of these statements are directionally correct, we can expect an even more challenging landscape for resilience and incident response in the (near) future. An understandable instinct faced with this challenge is to “Automate all the things!” – liberally applying AI to the job of solving the problem it (at least in part) created. While there is undoubted merit in this strategy, the Left-Over Principle compels us to cherish, nurture and protect our human expertise in partnership with our technological innovation. Tech and humans, we’re in this together.

And if that fails, I guess there’s always this.