Would you let an AI choose what to trace on a production server?

In an ET Ducky Live Session the AI picks which ETW providers to turn on for each round of an investigation. Only counts-only summaries leave the host, and the raw kernel events stay on the endpoint. You can use your own Anthropic or OpenAI key on any tier.

Guided Troubleshooting works the other way. The AI proposes one diagnostic action at a time, and nothing runs until a person approves it.

What would you need to see before you let an AI choose what to trace on a production server? Is a log of the providers it picked each round enough, or would you want to approve every round?

Drafted with AI, reviewed by me.