Picture an agent about to push a change to a production router. It has pulled the running configuration, reasoned about the intent, and generated a clean set of commands. The plan looks right, so you approve it. Then you give the same agent the same prompt an hour later, and it produces a subtly different plan. Same goal. Different path. Both plausible.
That second part is what most of the agentic AI conversation politely skips over.
We have spent two years marveling at how well large language models reason about infrastructure. They can read a config, explain a routing decision, draft a change, and summarize an incident faster than most of us can find the right runbook. That capability is real, and it is not the problem. The problem is that everything underneath it runs on a principle the models do not share: determinism.
Infrastructure Runs on Repeatability
Infrastructure operations are built on repeatability. Run the playbook twice, get the same result. Apply the change, and the next person who applies it lands on the identical state. Idempotency is not a nice-to-have in this world. It is the load-bearing assumption that lets us sleep through a maintenance window. We trust automation precisely because it is boring. It does the same thing every time, and when it does not, that is a bug we can go find.
Large language models are stochastic by design. Temperature, sampling, token order, a model-version bump from a provider you do not control: any of these can change the output. That property is a feature when you want three different summaries or a fresh approach to a problem. It is something else entirely when the output is a command that touches BGP.
So the real question in agentic infrastructure is not, can the model reason about my network? It clearly can. The question is how you put a non-deterministic system in charge of a domain that demands deterministic outcomes, without lying to yourself about which one you are actually running.
The Tempting Answers Are Mostly Wrong
The first is to set the temperature to zero and call it deterministic. Lower variance is not no variance, and it does nothing about the model that shifts under you when the provider ships an update. You have reduced the odds, not bounded the behavior.
The second is to put a human in front of every action and call the approval a safety net. At the scale and speed agents are meant to operate, a person eyeballing every generated change is not oversight. It is a slower version of the bottleneck we adopted agents to remove, and worse, it manufactures the illusion of control. Anyone who has approved the fortieth nearly identical change at 2 a.m. knows exactly how much scrutiny the forty-first one gets.
The third is to wait for the models to get good enough that this stops mattering. They will get better. They will not become deterministic. That is not a maturity gap you can wait out. It is the nature of the thing.
Probabilistic Reasoning, Deterministic Action
What actually works starts with a separation most teams have not drawn cleanly yet: let the model be probabilistic about what to do, and force the system to be deterministic about how it gets done.
The reasoning layer can be fuzzy. Let the agent interpret intent, weigh options, and propose a course of action. That is what it is good at. But the moment that proposal becomes an action on real infrastructure, it should flow through the same execution path you already trust. Validated logic. Known inputs and outputs. Pre-checks and post-checks. Rollback that actually works. An audit trail that records not just what changed, but the reasoning that produced it.
In practice that means the agent does not type commands at a device. It calls a defined capability, the same way a workflow or a human operator would, and that capability behaves identically no matter how the agent arrived at the decision to call it. The model picks the destination. The rails are fixed. Two different reasoning paths that reach the same intent produce the same action, because the action is not improvised. It is invoked.
This is not a glamorous conclusion. It says the exciting part of agentic AI, the open-ended reasoning, has to be fenced off from the part of your stack where surprises get measured in outage minutes. But it is the only version of this that survives contact with production.
We’ve Taken This Class Before
We learned a version of this lesson once already. A decade ago, “automate everything” crashed into the reality that automation you cannot predict is not automation. It is a faster way to make mistakes. The teams that came through it kept the parts that were bounded and trusted, and quietly retired the rest.
Agentic AI is about to teach the same class. The syllabus has not changed. Reasoning is probabilistic. Infrastructure is not. Build for the gap, or your network will find it for you.
