Insights from the 2026 State of Application Strategy Report
There’s a quiet shift happening in operations, and it’s easy to miss if you’re still thinking about AI as a decision-support tool.
It isn’t just advising anymore. It’s acting.
Our data makes that transition hard to ignore. Sixty-seven percent of organizations are already using AI to accelerate automation efforts. Sixty-six percent are allowing AI to automatically adjust policies and configurations to meet SLAs and SLOs. Another 59% rely on AI to generate recommendations that guide human action. Only 2% report not using AI for automation at all.
That distribution tells a very specific story. AI is no longer sitting outside the control loop. It is embedded inside it.
AI is executing, but only where it’s safe to fail
At first glance, those numbers suggest we’ve crossed into full autonomy. We haven’t.
What we’re seeing instead is selective execution. Organizations are comfortable letting AI act directly when the blast radius is constrained and the outcome is measurable. Traffic shaping, performance tuning, cost optimization. These are domains where actions can be observed, evaluated, and reversed quickly.
That’s not accidental. It reflects a clear trust boundary.
AI is allowed to move fast where failure is tolerable and recovery is straightforward. It is not being given the same freedom in areas tied to compliance, security posture, or business-critical policy. Those domains still require human oversight, not because AI is incapable, but because the risk profile is fundamentally different.
In practice, this means your “next SRE” might very well be a machine, but it’s one operating under strict guardrails, not an independent operator making unconstrained decisions.
This is control-plane augmentation, not replacement
What’s interesting is how closely this maps to patterns we’ve seen before.
Autoscaling did not eliminate operators. Traffic management did not remove the need for policy. Policy automation did not erase governance. Each of those shifted responsibility into the system while preserving oversight at the architectural level.
AI is following the same path.
Enterprises are decomposing operational authority. They are granting AI execution rights in narrowly defined domains while retaining control over high-risk decisions. That is not a lack of trust. It is an architectural choice.
AI is being absorbed into the control plane, not elevated above it.
The value of AI is speed and signal, not autonomy
If there’s any lingering doubt about how organizations view AI’s role, the benefits data clears it up quickly.
The top expected outcomes from GenAI are faster decision making at 33% and productivity improvements through adaptive learning at 32%. Cost savings, strategic planning, and compliance all trail behind.
That ordering matters.
Enterprises are not prioritizing autonomy. They are prioritizing speed and signal quality. They want better decisions, made faster, embedded directly into workflows. That aligns perfectly with the earlier data showing that 59% of organizations rely on AI-generated recommendations while a similar share allows limited automatic action.
Authority is being earned incrementally. First through recommendations, then through constrained execution.
Control concentrates at the point of intent
When you overlay this with where delivery and security teams see the most impact, the architecture sharpens further.
The prompt layer leads for delivery at 29% and for security at 25%, followed closely by token and control layers at 23% for both. Model routing and output moderation matter, but they lag behind.
That concentration is not accidental.
If your goal is faster decisions and higher productivity, the highest leverage point is where intent enters the system. That is where prompts are formed, context is assembled, and constraints can be applied before execution.
Enterprises are optimizing the front door of inference because it allows them to shape outcomes without relinquishing control.
It also reinforces a broader shift: models are increasingly treated as interchangeable execution engines. The intelligence, from an operational perspective, is moving up the stack into the delivery fabric that governs how requests are shaped, routed, constrained, and observed.
AI is becoming an operator, but not an owner
Put all of this together and a consistent pattern emerges.
AI is embedded in the control loop. It is trusted to act, but only within defined boundaries. It is valued for speed and signal, not unchecked autonomy. It’s governed through the same architectural principles that have always defined application delivery and security.
That makes AI an operator, but it doesn’t make it an owner.
And that distinction is where most of the industry conversation still falls short. The hard problem is no longer teaching AI how to make decisions. The hard problem is designing the systems that determine where it is allowed to act, when it must defer, and how its actions are observed, constrained, and reversed.
That is not an AI problem. It is an enterprise architecture problem.
The organizations that recognize that will scale AI safely and effectively. The ones that don’t will either over-constrain it into irrelevance or over-trust it into risk.
Either way, the outcome is the same. They will fall behind systems that already understand that the next SRE isn’t replacing the team.
It’s joining it.
To learn more, read the full 2026 State of Application Strategy Report .
About the Author
Lori MacVittie is a Distinguished Engineer and Chief Evangelist in F5’s Office of the CTO with deep expertise in application delivery, automation strategy, and infrastructure. She is known for turning complexity into clarity whether she’s defining guardrails for AI agents, dissecting brittle multicloud architectures, or probing the limits of scalable systems. She brings more than thirty years of industry experience across application development, IT architecture, and network and systems operations. Before joining F5, she served as an award-winning technology editor. MacVittie holds an M.S. in Computer Science and is a prolific author whose publications span security, cloud, and enterprise architecture. She is also an avid tabletop and video gamer with unapologetically strong opinions about cheese.
More blogs by Lori Mac VittieRelated Blog Posts
Your next SRE might be a machine
Control is concentrating at the point of intent: prompts, tokens, and routing. The architecture challenge is defining where AI can act, when it must defer, and how to reverse.
The secret to scaling AI is overcoming Conway’s Law
AI won’t scale by itself. Without a unified control plane that collapses tooling and ownership boundaries, inference becomes the most brittle and coordination-heavy tier.
Identity is the gatekeeper to agentic AI
As agentic AI shifts machines from tools to actors, identity becomes the core control: who can act, on whose behalf, with what scope—enforced inline at inference time.
Inference is now the center of operational gravity
Multi-model operations and API-driven automation push control to inference-time layers—prompt, token/control, routing, and moderation—where cost, risk, and performance must be managed.
AI, inference, and tokens, oh my!
AI applications run on inference servers, driven by tokens—not traffic. Discover why understanding tokens and JSON data is critical to designing smarter infrastructure.