The Network That Answers Back
Agentic NetOps with the panic button still in your hand
[!note] This is the chosen flagship talk (Talk B) Track: Hybrid infrastructure · Theme: Intelligent automation for scale & speed · Depth: 301 Format: 15 min live demo + 15 min Q&A · Target month: October 2026 Parent: lightning-talk-oct2026-requirements
1. 🧭 TL;DR
Wire an AI agent directly to a network source-of-truth (NetBox or Nautobot) over the Model Context Protocol (MCP), and let it answer the question every network engineer has been paged about at 2 a.m.: "What actually breaks if this link goes down?" The agent reasons across topology, IPAM, and dependencies, returns the blast radius in seconds, and drafts a remediation change — then stops, because every action is propose-only, approval-gated, and validated against a digital-twin sandbox before anything touches a real device. It's a running PoC on synthetic data that any infrastructure team can adopt as a triage co-pilot, with a bank's guardrails baked in from line one.
2. 🎣 The Hook (opening 60 seconds)
Every network engineer has lived this: a page fires, and someone asks "what's the blast radius if we drop this link?" Today that answer lives in three browser tabs, two tribal-knowledge Slack threads, and one person who's on vacation. The source of truth exists — it's just not something you can talk to.
This talk makes it something you can talk to. And the entire point is the line the agent won't cross.
3. 📝 Submission-Ready Abstract
The Network That Answers Back — Agentic NetOps with the panic button still in your hand Track: Hybrid Infrastructure · Theme: Intelligent automation for scale & speed · Depth: 301
Every network engineer has been paged at 2 a.m. and asked the same question: "What actually breaks if this link goes down?" Today that answer lives in three tabs, two tribal-knowledge Slack threads, and one person who's on vacation.
In this 15-minute live demo, I wire an AI agent directly to a network source-of-truth (NetBox/Nautobot) over the Model Context Protocol — the standard that just shipped its hardened 2026 spec — and ask it that exact question out loud. It reasons across topology, IPAM, and dependencies, returns the blast radius in seconds, and drafts a remediation change. Then it stops. Because the whole point of this talk is the line it won't cross: every action is propose-only, approval-gated, and validated against a digital-twin sandbox before anything touches a real device.
This isn't a vision deck. It's a running proof-of-concept, on synthetic data, that any infrastructure team can adopt as a triage co-pilot on Monday — with the guardrails a bank requires baked in from line one. Attendees leave knowing how to connect an LLM to their own source of truth, where agentic autonomy is safe (triage, blast-radius, drafting) versus where it isn't (blind execution), and why the approval gate — not the model — is the real engineering.
You'll leave able to: connect an agent to live infra via MCP · design approval gates and sandboxes that keep autonomy safe · tell the safe agentic wins from the dangerous ones.
Bring your hardest "what if it goes rogue?" question to the Q&A. I have an answer.
[!tip] Why this abstract is engineered to be picked Concrete live demo (not slideware) · fresh 2026 tech (MCP spec) · direct domain relevance (Network) · an explicit safety story a bank can say yes to · a closing line that invites the scariest Q&A, signaling confidence. That combination is what beats vision decks in selection scoring.
4. 🎯 Learning Outcomes
Attendees leave able to:
- Connect an agent to live infrastructure via MCP — the source-of-truth-as-tool pattern.
- Design approval gates and sandboxes that keep autonomy safe (propose-don't-push, digital-twin validation).
- Distinguish safe agentic wins from dangerous ones — triage / blast-radius / drafting (safe) vs. blind config execution (not).
5. ⚙️ PoC / MVP Architecture
┌─────────────────────────┐
│ Network Source of Truth │ NetBox (or Nautobot)
│ topology · IPAM · DCIM │ synthetic sample data
└────────────┬─────────────┘
│ MCP server (open-sourced by NetBox Labs)
│ + llms.txt context
▼
┌─────────────────────────┐
│ Agent Loop │ Claude (Agent SDK / Claude Code)
│ reason → call tool → │ read-only + propose-only tools
│ inspect → repeat │
└────────────┬─────────────┘
│ drafts a change (never executes)
▼
┌─────────────────────────┐
│ Approval Gate │ human-in-the-loop; nothing
│ (propose-don't-push) │ ships without a click
└────────────┬─────────────┘
│ approved draft
▼
┌─────────────────────────┐
│ Digital-Twin Sandbox │ change tested in the twin
│ (validate before field)│ BEFORE it touches real gear
└─────────────────────────┘
Components
- Source of truth: NetBox (documentation-heavy) or Nautobot (automation-driven — forked from NetBox in 2021, Django + PostgreSQL). Either exposes topology, IPAM, and DCIM as the agent's semantic map / ontology.
- Bridge: NetBox Labs' open-source MCP server +
llms.txt— gives the LLM structured, governed access to source-of-truth data as tools. Rides the MCP 2026-07-28 spec (stateless core, Tasks, hardened auth). - Agent loop: conceptually simple — reason → call tool → inspect result → repeat until done. Tools scoped read-only for querying and propose-only for changes.
- Approval gate: the whole safety thesis. The agent produces a draft change; a human approves before anything leaves the room.
- Digital-twin sandbox: approved drafts are validated in a twin first — the twin is the blast-shield between the agent and the field network.
6. 🎬 Demo Run-of-Show (15 min)
| Time | Beat | What the audience sees |
|---|---|---|
| 0:00–1:00 | The 2 a.m. page | The hook. The question. The three-tabs-and-a-vacation problem. |
| 1:00–3:00 | Meet the source of truth | NetBox/Nautobot with synthetic topology + IPAM. "This already exists. You just can't talk to it." |
| 3:00–4:00 | The wiring | One slide: agent → MCP server → source of truth. Name-drop the 2026-07-28 MCP spec. |
| 4:00–8:00 | Ask it out loud | "What breaks if link X drops?" Agent reasons across topology/IPAM/dependencies → returns blast radius (affected devices, prefixes, tenants) in seconds. |
| 8:00–11:00 | It drafts — then stops | Agent proposes a remediation change. Freeze on the approval gate. "It will not push. This is the line." |
| 11:00–13:00 | The twin | Approved draft validated in the digital twin before field. Show the sandbox catching/confirming. |
| 13:00–15:00 | Safe vs. unsafe autonomy | The takeaway slide: triage / blast-radius / drafting = safe. Blind execution = not. The approval gate is the engineering. |
[!tip] Recording safety Film once on synthetic data only — no real RBC device names, IPs, or topology. Narrate live over the recording so a flaky live agent call never sinks the talk.
7. 🛡️ Safety Framing (bank-critical)
This is a 301 talk to a financial-institution audience — the safety story is not a footnote, it's the spine:
- Propose-don't-push — the agent's write tools produce drafts, never commits. Mirrors the same design already proven in Hermes's validator/fix-agent split (fix-agent proposes, validator + human gate before anything lands).
- Read-only by default — querying the source of truth is unrestricted; mutating anything requires the gate.
- Digital-twin sandbox — LLM output is tested in the twin before the field, so a bad draft never reaches real gear.
- Full audit path — under the MCP 2026 spec, every UI-initiated action goes through the same audit + consent path as a direct tool call. Nothing happens off-book.
- Safe-win framing — Gartner's own guidance: the safe first wins are triage, validation, and approval-gated remediation, not blind config pushes. This talk demos exactly the safe wins.
8. 🆕 Why It's Timely (the "recently dropped" hooks)
- MCP 2026-07-28 spec — stateless core, Tasks extension, MCP Apps, hardened authorization + formal deprecation policy. Landed weeks before the talk.
- NetBox Labs open-sourced an MCP server +
llms.txt— the exact source-of-truth bridge, no bespoke integration needed. - Agentic NetOps is a live category — Gartner forecasts ~70% enterprise adoption of agentic infra ops by 2029; Cisco (NetAI + source of truth) and Selector are publishing the "networks that manage themselves — safely" narrative now.
- Digital twin as sandbox — the emerging best practice: test agent output in the twin, then push to field.
- Harness engineering formalized as the field's 3rd maturity phase (prompt engineering → context engineering → harness engineering) — "Agent = Model + Harness," five layers: tool orchestration, verification loops, context/memory, guardrails, observability. The number worth saying out loud on stage: 65% of enterprise AI agent failures trace to harness defects — context drift, schema misalignment, state degradation — not model weakness. That statistic is the argument for the approval gate + digital twin in this talk: the harness, not the model, is what's being engineered here.
- Karpathy's "LLM Wiki" pattern (April 2026) — instead of RAG re-deriving answers from raw documents on every query, an agent incrementally compiles a persistent, structured, cross-linked knowledge base that compounds over time. Independently, Hermes already does exactly this for this vault — worth a one-line callback if this talk runs alongside the companion self-healing-knowledge talk (Talk A, now reframed around this exact pattern — see lightning-talk-oct2026-requirements §6).
9. ❓ Q&A Prep — Anticipated Questions
[!warning] The #1 bank question is always: "What stops it going rogue / doing damage?" Answer: it structurally cannot execute. Write tools are propose-only, every mutation hits a human approval gate, and approved changes are validated in a digital twin before the field. The model isn't trusted with autonomy — the harness withholds it.
| Question | Answer |
|---|---|
| "What if the source of truth is wrong/stale?" | Then the agent is wrong — garbage in, garbage out. This is why "The Compounding Wiki" (Talk A) is the companion: keep the source true first. Also: the twin catches drift between model and reality. |
| "Does this need a frontier model?" | No — and there's a number to back it up: 65% of enterprise AI agent failures trace to harness defects (context drift, schema misalignment, state degradation), not model weakness. The loop here is model-agnostic — the harness (tools, gates, twin) does the reliability work, not raw model IQ. Swap models freely. |
| "How is this different from existing AIOps?" | Classic AIOps reduces noise + speeds RCA. This adds goals, reasoning, and drafted action on top — but keeps a human on the trigger. Additive, not a replacement. |
| "What about prompt injection via tool results?" | Real risk — the MCP 2026 spec hardens the audit/consent path; combine with scoped read-only tools and the approval gate. (This is the seed of the backup "Orchestrated Security for MCP" talk.) |
| "Can it actually push a change eventually?" | Yes — but that's a deliberate, separately-governed step behind the gate + twin, not a demo default. Autonomy is earned incrementally, starting with the safe wins. |
| "NetBox or Nautobot — which?" | NetBox suits documentation-heavy teams; Nautobot targets automation-driven environments. Same MCP pattern applies to both. |
10. ✅ Build Checklist → October
- Stand up NetBox (or Nautobot) locally with a synthetic topology + IPAM dataset (no real RBC data).
- Wire the NetBox Labs open-source MCP server +
llms.txt. - Build the agent loop (Claude Agent SDK / Claude Code) with read-only query + propose-only change tools.
- Implement the approval gate (human click before any mutation is emitted).
- Stand up a minimal digital-twin sandbox step (even a stub that validates the drafted change against the twin's model).
- Script + film the demo once on synthetic data; prepare live narration.
- Rehearse the 3 Q&A landmines (rogue / stale source / prompt injection).
- One-slide architecture diagram + one-slide "safe vs. unsafe autonomy" takeaway.
11. ⚠️ Risks / Open Questions
- Live agent flakiness on stage → mitigate by narrating over a pre-recorded run.
- Digital-twin scope — a full twin is heavy; for the MVP a validation stub against the source-of-truth model is enough to make the point. Decide MVP boundary early.
- NetBox vs. Nautobot decision — pick one for the demo; the pattern generalizes, but don't split effort.
- Sanitization — triple-check no real topology/IP/device names leak into a recorded artifact.
12. 🔬 Personal Research Roadmap — Path to Sept 1, 2026
[!note] Deadline math Today is 2026-07-10. Presentation (slides + demo, rehearsed) must be ready by 2026-09-01 — that's ~7.5 weeks. October delivery leaves a further 4-week rehearsal/polish buffer after Sept 1. Use it — don't burn it building.
The hardest unknown in this whole talk isn't the LLM — it's how "blast radius" actually gets computed and how small the digital twin can honestly be. Both need a real decision before slide-writing starts. Research those two first.
12.1 Research Topics & Guiding Questions
Each topic below maps to a trigger phrase from TechResearch's deep-research mode — use it verbatim to kick off a focused research session when you sit down to work on that topic.
| # | Topic | Guiding questions | Output | Trigger phrase |
|---|---|---|---|---|
| 1 | NetBox vs Nautobot — pick one | Which has more mature, actively-maintained MCP server support today? Which stands up faster via Docker for a throwaway demo env? Which data model (DCIM/IPAM) maps more naturally to a "what depends on this link" query? | Hands-on: stand up both for an afternoon, pick one, write the comparison | Compare: NetBox vs Nautobot for agentic NetOps demo |
| 2 | The MCP server for the chosen tool | What tools does it expose out of the box — read-only, or writes too? How is auth/scope handled? Does it already speak the 2026-07-28 spec (stateless core, Tasks)? | Research note + a working local install returning real query results | Research: NetBox MCP server |
| 3 | MCP 2026-07-28 spec itself (you need 301-depth command of this on stage) | What exactly is the Tasks extension, and would a slow blast-radius computation benefit from it? What changed in the auth/consent model that backs the "full audit path" claim in §7? What's stateless now that wasn't before, and why does that matter here? | Research note; optionally a toy MCP server exercising Tasks to feel it, not just read about it | Research: MCP 2026-07-28 spec — Tasks extension and stateless core |
| 4 | How "what breaks" actually gets computed ⚠️ highest-leverage topic | An LLM free-reasoning over topology text will hallucinate a blast radius under pressure. Batfish (Intentionet, open source) is purpose-built for exactly this — predicting the impact of a network change against a config snapshot, deterministically, before deploying it. Can it ingest a NetBox/Nautobot-exported topology? What's the minimum snapshot it needs? Fast enough to run live? Is there a Python client to wire it as a second agent tool (LLM orchestrates, Batfish computes)? | Hands-on trial against a small synthetic topology. Decide by end of Week 2 whether Batfish is in-scope for Sept 1, or whether the MVP fallback is a hand-rolled graph traversal in networkx |
Research: Batfish network configuration analysis engine |
| 5 | Approval-gate / propose-don't-push mechanics | What's the actual Claude Agent SDK mechanism for a tool that proposes but never executes — permission modes, a canUseTool-style callback, hooks? Can the exact permission-prompt UX you already see in Claude Code be the on-stage metaphor ("you've all seen this dialog before — same pattern, network changes instead of file edits")? How does this map onto Hermes's existing dispatcher/validator split? |
Hands-on: build the real gated tool; short note cross-linking hermes-harness-spec | Research problem: how to implement an approval-gated write tool in Claude Agent SDK |
| 6 | Digital twin scope ⚠️ decide first, not last | Is a full simulated twin (Containerlab / EVE-NG / GNS3) realistic by Sept 1 — or is a lighter "validate the diff against the topology model" stub enough to honestly earn the word "twin" on a slide? What's the smallest version that isn't a lie? | A scoping decision note — this is the single highest-risk item in the build | Research approach: lightweight digital twin validation for network config changes |
| 7 | Synthetic dataset that looks real on stage | Does NetBox/Nautobot's own demo-data generator produce a topology convincing enough to present, or does it need manual authoring? How do you engineer one link failure that produces a small, clean, explainable blast radius (a handful of dependent services, not 200 rows scrolling by)? | The actual seeded dataset + a fixture/seed script, reusable every rehearsal | (build task, not research — just do it) |
| 8 | MCP prompt-injection via tool results — your Q&A landmine | What's the current documented guidance (Anthropic / MCP community) on this? Concretely: if an attacker plants instructions in a NetBox device's free-text "notes" field, what happens — and does read-only scoping actually stop it? | A note that directly hardens Q&A table row 4 (§9) and seeds the backup security talk | Research: MCP tool-result prompt injection mitigations 2026 |
| 9 | Prior art / competitive framing | Has Cisco, Selector, or anyone shown a recorded demo of something adjacent? What did they show — and conspicuously not show — that calibrates what "safe wins" should look like on your stage? | Short competitive-scan note; sharpens the pitch, not something to copy | (reading/watching, no formal research doc needed) |
12.2 Week-by-Week Plan (Jul 10 → Sept 1)
| Week of | Focus | "Done when" |
|---|---|---|
| Jul 14 | Topics 1, 2, 3 — foundations. Stand up NetBox and Nautobot, pick one. Read the MCP spec cover to cover. | You can explain the 2026-07-28 spec unaided, and one source-of-truth tool is running locally with real (synthetic) data in it. |
| Jul 21 | Topic 2 continued — wire the MCP server, confirm Claude can query it. First read-only question answered live: "what's on device X?" | A Claude session returns a correct answer sourced from your local NetBox/Nautobot instance. |
| Jul 28 | Topic 4 — Batfish trial. This is the make-or-break week: decide Batfish vs. networkx fallback. |
The "blast radius" question has one deterministic, demoable answer path — decided, not open. |
| Aug 4 | Topic 5 — build the approval-gated propose-only tool. Draft representation for a "change" (diff/JSON patch), not a live execution. | Agent can draft a remediation change and visibly stop for human approval — the core safety beat of the talk works end to end. |
| Aug 11 | Topic 6 — implement whatever digital-twin scope you decided in Week 3. Keep it honest and small. | An approved draft passes through some validation step before being called "safe" — even a stub, as long as it's real. |
| Aug 18 | Topic 7 — build and polish the synthetic dataset until one specific link failure tells a clean story. Topic 8 & 9 — fold hardened answers into §9's Q&A table. | Full pipeline (ask → blast radius → draft → approve → validate) runs start to finish, at least once, without hand-waving. |
| Aug 25 | Rehearsal week. Two to three full dry runs. Record the backup video (synthetic data only, per §6's safety note). Draft slides from §3–§9 of this doc. | You can do the full 15 minutes from memory, on time, with a recorded fallback in hand. |
| Sept 1 | Presentation-ready checkpoint (see §12.3). | Everything in the checklist below is checked. |
| Sept – early Oct | Buffer: run it past a colleague or two, especially someone skeptical of agentic anything. Tighten based on their reaction, not just your own read. | Talk is unchanged in substance, sharper in delivery. |
12.3 Definition of "Presentation-Ready" by Sept 1
- Slides drafted end-to-end, timed to ~13–14 min (leave slack under the 15-min cap)
- Live demo pipeline runs start to finish at least once, unscripted
- Backup recording exists (synthetic data only) in case live/stage Wi-Fi betrays you
- All 6 Q&A table answers (§9) rehearsed out loud, not just read
- The Batfish-vs-fallback and digital-twin-scope decisions (Topics 4 & 6) are made, not still open
- At least one dry run in front of another person, feedback incorporated
13. 📎 References
- MCP 2026-07-28 Release Candidate — https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
- 2026 MCP Roadmap — https://blog.modelcontextprotocol.io/posts/2026-mcp-roadmap/
- Two New Ways to Use AI With NetBox (NetBox Labs, MCP server + llms.txt) — https://netboxlabs.com/blog/new-ways-use-ai-netbox-open-sourced/
- Build Your First NetBox AI Agent (workshop recap) — https://netboxlabs.com/blog/build-your-first-netbox-ai-agent-workshop-recap/
- Bringing Source of Truth to Your NetAI Agentic Playground (Cisco) — https://blogs.cisco.com/learning/bringing-some-source-of-truth-to-your-netai-agentic-playground
- How Agentic AI is Redefining Network Operations (Selector) — https://www.selector.ai/blog/how-agentic-ai-is-redefining-network-operations/
- Rise of Agentic AI in NetOps (FirstPassLab) — https://firstpasslab.com/blog/2026-04-15-rise-of-agentic-ai-when-networks-manage-themselves/
- Nautobot vs NetBox 2026 — https://netodata.io/nautobot-vs-netbox-2026/
- Context Drift Causes 65% of Enterprise AI Agent Failures (MemU) — https://memu.pro/blog/ai-context-drift-enterprise-agent-memory
- What Is Harness Engineering AI? The Definitive 2026 Guide (Atlan) — https://atlan.com/know/what-is-harness-engineering/
- Karpathy's LLM Wiki: A Knowledge Base That Compounds — https://www.aibuilderclub.com/blog/karpathy-llm-wiki
- Karpathy's LLM Wiki as Agent Memory (AAIF) — https://aaif.io/blog/karpathys-llm-wiki-as-agent-memory/