When the Observer Acts: Threat Modeling Agentic AI in Observability Pipelines

Abstract

Observability platforms have historically been read-only consumers of telemetry: they collected, correlated, and displayed. Recent reference architectures for generative and agentic root cause analysis (RCA) break that assumption. When an initial diagnosis falls below a confidence threshold, the system invokes an agent that autonomously queries monitoring tools, reads source repositories, and executes policy-driven actions until sufficient evidence is assembled. The observer has become an actor. This paper argues that the security consequences of that shift have not been systematically analyzed, and supplies the missing analysis. Taking the four-layer GenAI-driven observability architecture of [1] as a representative system under analysis, we construct an explicit threat model: three trust zones, three trust boundaries, four adversary classes, and nineteen threats enumerated with STRIDE across seven architectural elements. We then trace three end-to-end attack chains that each cross all three boundaries, the most consequential being telemetry-borne instruction injection, in which an adversary who can influence a single application log line reaches the production control plane without ever authenticating to the observability platform. Two structural properties make agentic observability distinctively exposed: telemetry is attacker-influenced input that has never been treated as such, and the diagnostic agent necessarily holds broad standing read privilege across the estate. We propose twelve design-level controls organized into four families — provenance, corpus integrity, least authority, and accountability — and identify the residual risks that no current control fully addresses. This work is analytical in scope. It contributes no implementation and reports no experiments; its purpose is to establish the threat vocabulary and design constraints that empirical work in this area will need.