"No Telemetry, No Deployment": Gartner Says Uncapped Token Pricing Puts Agent Budgets 50% Over

On October 26, 2026, Gartner published its view of infrastructure and IT operations for 2027: five AI trends spanning the role of agents in operations, the cost behaviour of autonomous workflows, hybrid AI infrastructure, the convergence of operations and security, and I&O's own evolution into an orchestrator of enterprise AI platforms. The forecast rests on a survey of 272 I&O heads conducted between April and May 2026, where 58% named scaling AI proofs of concept into I&O adoption as an important priority for the next twelve months. Jonathan Forest, VP Analyst at Gartner, offers the discipline that goes with it: put money into strategic investments with measurable business impact rather than trying to address every aspect of AI at once.

The pain is unpredictability, not price — a lesson 2026 kept repeating.

1. Agents in operations: from nearly zero to half in four years

The first forecast has a wide span. By 2030, 50% of organisations will use AI agents with minimal human involvement in IT operations, against nearly zero in 2026. The work Gartner names is specific: incident triage, change validation and remediation. What those share is a clear pass/fail judgement wrapped in research that a person currently does by hand — exactly the shape agents handle well. For engineering teams the practical reading is not "prepare to be replaced" but "build three things now": the agent's permission boundary, an audit trail of what it changed and on what basis, and the ability to roll back. Without those, the week the first agent ships becomes the week of the incident.

# The gate Gartner is describing, written as a schema you have to fill
# BEFORE the agent gets a production credential.
workflow_id: io-incident-triage
agent:
  name: triage-agent
  version: 2026-10-24
  tools: [read_alerts, read_runbooks, open_ticket]
budget:
  pricing_model: variable            # variable | committed | bundled
  monthly_cap_usd: 400
  per_run_cap_usd: 0.40
  alert_at_pct: [50, 80, 100]
telemetry:
  emits:
    - run.span                        # one span per agent invocation
    - run.tokens.input
    - run.tokens.output
    - run.tokens.cache_read
    - run.tool_calls
    - run.outcome                     # success | timeout | denied
  sink: otel
  retention_days: 30
  owner: platform-ops
# No emits block, no credential. That is the whole policy.

2. Token economics: what the 50% figure actually compares

The second forecast carries the most information. Through 2027, Gartner says enterprises using uncapped, variable pricing tied to token consumption for AI agents in IT operations will exceed initial cost expectations by more than 50% compared with organisations on predictable subscription and bundled pricing. That is routinely read as "models got expensive". It is a statement about pricing structure. Moving from conversational AI to autonomous agents multiplies the number of steps per task, and every step costs tokens, while nobody forecasts the step count of a hard task in year one. The action items are therefore two: model the break-even between variable and committed pricing, and cap each agent run rather than capping a team's monthly total. There is a second-order effect worth naming: because the step count is what varies, the same workflow can cost cents on a routine ticket and dollars on the one that needs eleven tool calls, which is why a single monthly number never tells you whether the system is behaving.

# Why ">50% over expectation" is a pricing-model statement, not a
# statement about model prices falling. Compare two ways to buy the same
# volume before you sign anything.

def compare(monthly_runs, avg_tokens_in, avg_tokens_out,
            price_in, price_out, committed_monthly_usd, run_cap):
    variable = monthly_runs * (
        avg_tokens_in / 1e6 * price_in + avg_tokens_out / 1e6 * price_out
    )
    # Agents retry. A hard task can cost 3x the median run.
    variable_tail = variable * 1.6
    committed = committed_monthly_usd
    return {
        "variable_usd": round(variable, 2),
        "variable_with_tail_usd": round(variable_tail, 2),
        "committed_usd": round(committed, 2),
        "worst_case_overrun_pct": round((variable_tail / run_cap - 1) * 100, 1),
        "breakeven_runs": round(committed / (variable / monthly_runs), 0),
    }

# The useful output is breakeven_runs, not the headline bill. If your
# agent fleet runs below breakeven, variable pricing is correct and the
# cap is what protects you; above it, the overrun is structural.

3. Turn "no telemetry, no deployment" into a gate

Gartner's recommendation is four words: no telemetry, no deployment. Said in a meeting, it survives about a week. Written as code, it holds. The implementation is a form every agent workflow must fill before it gets a production credential: pricing model, monthly cap, per-run cap, and the telemetry it will emit — one span per invocation, input, output and cache-read tokens, tool call count, and outcome (success, timeout, denied). Then the field most teams skip: a named owner for that telemetry. Cost with no owner is cost nobody forecasts, which is precisely the failure mode the forecast describes. As a CI check the maintenance cost approaches zero and it blocks the most expensive class of mistake. The gate also changes procurement conversations. Once each workflow publishes its own ceiling, the finance question stops being "what will AI cost us" and becomes "what does this workflow cost at p95", which is a question an engineer can answer.

By 2029, 80% of large enterprises will run production AI workloads across at least three environments.

# Enforcement, not exhortation. This runs in CI and blocks the deploy.
import json, sys

REQUIRED_EMITS = {
    "run.span", "run.tokens.input", "run.tokens.output",
    "run.tokens.cache_read", "run.tool_calls", "run.outcome",
}

def gate(path):
    cfg = json.load(open(path))
    tel = cfg.get("telemetry") or {}
    emits = set(tel.get("emits") or [])
    missing = REQUIRED_EMITS - emits
    problems = []
    if missing:
        problems.append(f"missing telemetry: {sorted(missing)}")
    if not cfg.get("budget", {}).get("monthly_cap_usd"):
        problems.append("no monthly_cap_usd")
    if not tel.get("owner"):
        problems.append("telemetry has no named owner")
    if problems:
        print("BLOCKED by no-telemetry-no-deployment policy:")
        for p in problems:
            print(" -", p)
        sys.exit(1)
    print("gate passed:", cfg["workflow_id"])

# The owner field is the part teams skip. Cost with no owner is cost
# nobody forecasts, which is exactly the failure mode Gartner describes.

4. Hybrid infrastructure: three environments is a capacity plan

The third forecast holds that by 2029, 80% of large enterprises will run production AI workloads across at least three infrastructure environments — public cloud, neocloud providers, on-premises data centres and edge locations. Gartner attributes the shift to privacy, cost, performance and data sovereignty pulling at once. For anyone implementing, the consequence is concrete: every additional environment adds an identity system, an egress path and another monitoring integration. So the right move is not "put the workload wherever there are GPUs" but a written placement policy: which data classes may leave the network, what the monthly egress budget is, what the latency budget is. One rule earns its keep immediately — a workload classified as restricted data should not appear in any environment that requires egress.

# Placement policy for the hybrid reality: production AI on public cloud,
# neocloud, on-prem and edge at the same time. Write the rules down once.
placement:
  workloads:
    - name: ticket-classifier
      data_class: internal
      environments: [public_cloud, on_prem]
      egress_budget_gb_month: 50
    - name: transcript-summariser
      data_class: restricted
      environments: [on_prem]          # sovereignty: no egress
      gpu: L40S
    - name: store-inference
      data_class: public
      environments: [edge, neocloud]
      latency_budget_ms: 300

policy:
  deny_if:
    - data_class == "restricted" and environment != "on_prem"
    - egress_gb_month > egress_budget_gb_month
  cost_attribution:
    tag_keys: [workload, environment, owner]
  review: quarterly

# Three environments is a capacity plan, not an architecture diagram:
# every extra environment duplicates identity, egress and monitoring.

5. NOC and SOC merge, and I&O becomes the orchestrator

The fourth forecast brings numbers: by 2030, 25% of enterprises will merge their network operations centres and security operations centres, up from 5% in 2026, and the combined function could cut total spending on tools and staff by more than 25%. The logic matches the earlier convergence of observability and security — once an agent holds cross-stack access, one wrong action is both an outage and a security event. In engineering terms the merge starts as a query: align operational and security events by asset and time, and surface the assets that appear in both within the hour. The fifth forecast reads like a conclusion: through 2030, organisations without a strong I&O function driving AI infrastructure design, architecture and support will be more than twice as likely to fail in their AI initiatives. Forest's framing is that AI infrastructure is too expensive for much error, so treat I&O as an orchestrator rather than a gate.

By 2030, 25% of enterprises will merge NOC and SOC, up from 5% in 2026.

-- NOC meets SOC: one correlation view, not two dashboards.
-- Join operational signals to security signals by asset and time,
-- then rank by blast radius rather than by source system.
WITH ops AS (
  SELECT asset_id, ts, 'ops' AS source, severity, signal
  FROM ops_events
  WHERE ts > now() - INTERVAL '1 hour'
), sec AS (
  SELECT asset_id, ts + INTERVAL '0 second' AS ts, 'sec' AS source,
         severity, signal
  FROM security_events
  WHERE ts > now() - INTERVAL '1 hour'
), merged AS (
  SELECT * FROM ops UNION ALL SELECT * FROM sec
)
SELECT
  asset_id,
  count(*) FILTER (WHERE source = 'ops')            AS ops_signals,
  count(*) FILTER (WHERE source = 'sec')            AS sec_signals,
  max(severity)                                     AS top_severity,
  min(ts)                                           AS first_seen,
  max(ts)                                           AS last_seen
FROM merged
GROUP BY asset_id
HAVING count(DISTINCT source) = 2
ORDER BY max(severity) DESC, ops_signals + sec_signals DESC;

-- Assets appearing in both systems within the hour are the ones worth
-- a human. "Merged NOC and SOC" is a query before it is an org chart.