DEV Community

Andrea Schiona
Andrea Schiona

Posted on

How to Build an Agentic IT Organization Using IT4IT as the Control Architecture

#it4it #enterprise #devops

1. Why now

In the last 18 months, AI agent orchestration moved from papers into production tooling: LangGraph, CrewAI, watsonx Orchestrate, Microsoft Agent Framework, ServiceNow, and Automation Anywhere all introduced agentic AI concepts for ITSM and operations.

But there is a gap: none of these models explain where an agent must act inside the IT service lifecycle, who authorizes it, and how the outcome is measured in business terms.

This is where IT4IT comes in. Not as a process to follow, but as a reference architecture that defines the boundaries, data, and value flows within which agents can operate.

2. IT4IT is not a process — it is an architectural backbone

The IT4IT Reference Architecture (The Open Group, v3.0.1) defines four end-to-end value streams:

  1. Strategy to Portfolio (S2P)
  2. Requirement to Deploy (R2D)
  3. Request to Fulfill (R2F)
  4. Detect to Correct (D2C)

Each value stream is defined by:

  • Functional Components (what happens)
  • Key Data Objects (what moves)
  • Service Model (how the service evolves)

This structure is vendor-independent, methodology-agnostic, and tool-agnostic. It is therefore the single source of truth for mapping any agentic implementation, instead of letting each tool decide what “development” or “production” means.

3. Map the 4 value streams to specialized agents

The approach is to replace or augment human executors with purposed agents, keeping the IT4IT architecture unchanged. Each agent is constrained to:

  • a value stream (valueStream)
  • an IT4IT section (it4itSections)
  • an explicit tool grant set
  • a HITL (Human-In-The-Loop) tier level

Practical example for Requirement to Deploy:

IT4IT Functional Component Specialized Agent Autonomy Human Control
Requirement Agentic requirements analyst HITL 2 (review) Architect approves backlog
Plan & design Planning agent HITL 1 (approve) PM approves milestones
Develop Coding agent HITL 3 (autonomous) Mandatory post code review
Test QA automation agent HITL 3 Escalation only on anomalous failures
Deploy Release agent HITL 1 Change approval board

The same pattern applies to the other streams:

  • S2P: portfolio, demand, prioritization agents
  • R2F: catalog, provisioning, chargeback agents
  • D2C: monitoring, root-cause, remediation agents

4. Hierarchy, identity, and human controls

To avoid the chaos of “N agents doing whatever they want,” the operating model requires three layers:

4.1 Three-level hierarchy

  1. Orchestrators — receive objectives, decompose, assign to specialists
  2. Specialists — execute vertical tasks (gap analysis, security audit, investment scoring)
  3. Executors — interact with tools and data, under restricted grants

This structure reduces complexity: the orchestrator manages the flow, the specialist manages the domain, the executor manages the action.

4.2 Identity and traceability

Every agent has a durable identity (e.g. gaid:priv:dpf.internal:coo-orchestrator) and an execution ledger that records:

  • which grant was used
  • which prompt/version
  • which outcome
  • who supervised

This enables audit, debugging, and compliance.

4.3 Tiered HITL governance

Not “human-in-the-loop” as a slogan, but as a configurable parameter by role and risk:

  • Tier 0: human only
  • Tier 1: agent proposes, human approves
  • Tier 2: agent executes, human reviews post
  • Tier 3: agent autonomous, with automatic escalation on thresholds

Tiers are not uniform: an agent modifying firewall rules has Tier 1; an agent formatting reports has Tier 3.

5. Pros and cons — realistic

Pros

  • Structural alignment: IT4IT already defines flow boundaries; agents do not “invent” their role, they inherit it from the architecture.
  • Measurability: because every agent operates on IT4IT Key Data Objects, results are trackable as data, not chat.
  • Interoperability: if all agents speak the same data language (service release, requirement, incident), tools are no longer silos.
  • Gradual adoption: start with one value stream (e.g. Detect to Correct) without rebuilding the whole organization.
  • Governance by design: identity, grants, and HITL tiers are part of the model, not afterthought patches.

Cons

  • Mapping cost: every IT4IT Functional Component must be formalized into prompts, grants, and metrics. Not trivial.
  • Orchestration overhead: with 46 specialized agents (per models like DPF), you need a solid controller, or you add complexity instead of removing it.
  • Semantic lock-in: if IT4IT governs everything, switching to a future framework is more expensive than with generic tools.
  • Grant security: a misconfigured Tier 3 agent can propagate unchecked. Requires strict default-deny policies.
  • Organizational maturity: works only if the company already has clear strategy, portfolio, and data models. In organizational chaos, adding agents amplifies noise.

6. Concrete references

  • The Open Group IT4IT Standard v3.0.1 — defines the reference architecture and relationships between the 4 value streams.
  • ServiceNow IT4IT v3 Blueprint — functionally maps IT4IT onto real DevOps/ITSM tools, confirming implementability.
  • Rabobank / Shell / Delta Lloyd — official The Open Group case studies using IT4IT to streamline toolchains, reduce vendors, and improve time-to-market. The logical leap is replacing manual processes with governed agents.
  • OpenDigitalProductFactory — the only open-source project explicitly mapping agents onto valueStream and it4itSections, proving the coupling is technically feasible.
  • Microsoft — Agentic DevOps — shows how every phase of the development lifecycle can be assisted or governed by agents, confirming the feasibility of the R2D agentic model.
  • Deloitte — AI Agent Orchestration — highlights that enterprise success depends on orchestration and governance, exactly what IT4IT provides.

7. How to start without burning the organization

  1. Map tools first, not agents

    Use IT4IT to catalog existing tools into the 4 value streams. Find bottlenecks, silos, and duplications.

  2. Pick one value stream as a pilot

    Detect to Correct is the most common: monitoring, incident, problem. It has measurable outcomes (MTTR, incident count) and contained risk.

  3. Define 2–3 specialist agents, not 20

    Example: incident classification agent, runbook automation agent, root-cause suggester. HITL Tier 1–2.

  4. Lock identity and grants before prompts

    An agent without verifiable identity and explicit grants is noise in the system.

  5. Measure like IT4IT measures

    Use the framework’s Key Data Objects: service release lead time, requirement churn, fulfillment automation rate, detection-to-correction time.

  6. Publish a Decision Perspective Gate

    Even simple: every borderline agent action must show why it was taken, on which IT4IT criterion, and with what confidence level.

8. Bottom line for the board

Agentic IT is not a generic AI project. It is a governance architecture project in which agents are executors, and IT4IT is the model of what-to-build and when-to-act.

The benefits are real: transparency, speed, reduced toil, traceability. The risks are equally real: orchestration complexity, semantic lock-in, need for strict governance.

The safest approach is not “agents everywhere,” but one value stream at a time, with clear IT4IT boundaries and non-negotiable HITL.

Sources

  1. The Open Group — IT4IT Standard, Version 3.0.1 — https://publications.opengroup.org/c24a
  2. The Open Group — About IT4IT — https://www.opengroup.org/about-it4it%E2%84%A2
  3. The Open Group Blog — The IT4IT Reference Architecture is a Digital Product Blueprint (2022) — https://blog.opengroup.org/2022/05/24/the-it4it-reference-architecture-is-a-digital-product-blueprint-for-cost-savings-and-automation/
  4. The Open Group Blog — Who’s Using the IT4IT Standard: Banking/Insurance (2019) — https://blog.opengroup.org/2019/09/19/the-interesting-case-of-whos-using-the-it4it-standard-part-one-the-banking-and-insurance-sectors
  5. ServiceNow — IT4IT v3 Blueprint: Utah Version — https://www.servicenow.com/community/architect-articles/servicenow-it4it-v3-blueprint-utah-version/ta-p/2619269
  6. Tambo, T. et al. — Digital services governance: IT4IT for management of technology — Journal of Science and Technology Policy Management, 2019 — https://www.sciencedirect.com/science/article/pii/S1741038X19000518
  7. IAMOT 2017 — IT4IT as a Management of Technology Framework — https://pure.au.dk/ws/files/112882194/IAMOT_2017_IT4IT_AS_A_MANAGEMENT_OF_TECHNOLOGY_FRAMEWORK_proc.pdf
  8. OpenDigitalProductFactory — AI Agent Meta Model — https://github.com/OpenDigitalProductFactory/opendigitalproductfactory/blob/main/docs/architecture/ai-agent-meta-model.md
  9. OpenDigitalProductFactory — Gap Analysis Agent Prompt — https://github.com/OpenDigitalProductFactory/opendigitalproductfactory/blob/main/docs/superpowers/specs/2026-03-30-ai-coworker-skills-marketplace.md
  10. Microsoft — Agentic DevOps in action — https://developer.microsoft.com/blog/reimagining-every-phase-of-the-developer-lifecycle/
  11. D2i Technology — Complete Agentic SDLC Guide — https://d2itechnology.com/blogs/complete-asdlc-guide-requirements-to-deployment/
  12. Deloitte — AI Agent Orchestration (2026 TMT Predictions) — https://www.deloitte.com/us/en/insights/industry/technology/technology-media-and-telecom-predictions/2026/ai-agent-orchestration.html
  13. Deloitte — Agentic AI Orchestration, Governance, and Best Practices — https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/articles/agentic-ai-orchestration-governance.html

Top comments (0)