Introduction
Coming in Q3 2026, Red Hat's Automation Orchestrator combines three pillars into one governed pipeline: event detection (EDA), AI reasoning (AIA), and deterministic execution (AAP). The result: autonomous IT operations with human approval gates built in.
Architecture: The Three Pillars
┌────────────────────────────────────────────────────┐
│ Automation Orchestrator │
├──────────────┬──────────────┬──────────────────────┤
│ Event │ AI │ Deterministic │
│ Detection │ Reasoning │ Execution │
│ (EDA) │ (AIA) │ (AAP Controller) │
├──────────────┼──────────────┼──────────────────────┤
│ • Kafka │ • Root cause│ • Job Templates │
│ • Webhooks │ • Impact │ • Workflows │
│ • CloudWatch│ • Decision │ • Credentials │
│ • Prometheus│ • Approval │ • Inventory │
└──────────────┴──────────────┴──────────────────────┘
│ │ │
▼ ▼ ▼
Detect Event → Analyze+Decide → Execute+Verify
How It Works
Step 1: Event Detection (EDA)
# Event-Driven Ansible rulebook
---
- name: Detect infrastructure events
hosts: all
sources:
- ansible.eda.kafka:
topic: infra-alerts
host: kafka.internal:9092
rules:
- name: High CPU detected
condition: event.alert.metric == "cpu" and event.alert.value > 90
action:
run_orchestrator:
workflow: high-cpu-remediation
context: "{{ event }}"
Step 2: AI Reasoning (AIA)
The AI layer:
- Correlates the event with recent changes
- Assesses impact and blast radius
- Selects appropriate remediation playbook
- Determines if human approval is needed
Step 3: Deterministic Execution (AAP)
# Orchestrator workflow definition
---
workflow:
name: high-cpu-remediation
steps:
- name: Diagnose
template: diagnose-high-cpu
auto_approve: true
- name: Scale horizontally
template: scale-out-service
approval_required: true # Human gate
timeout: 15m
- name: Verify resolution
template: verify-metrics
success_criteria:
metric: cpu_percent
threshold: 70
duration: 5m
Human Approval Gates
| Risk Level | Approval Required | Timeout |
|---|---|---|
| Low (diagnostic) | None | — |
| Medium (restart) | Team lead | 15 min |
| High (scale/failover) | Platform owner | 30 min |
| Critical (data ops) | Change board | 1 hour |
Event Sources (12 New Collections)
EDA 2026 adds 12 new event source collections:
| Collection | Events |
|---|---|
ansible.eda.kafka | Message queue events |
ansible.eda.aws_eventbridge | AWS service events |
ansible.eda.azure_event_hub | Azure platform events |
ansible.eda.prometheus | Alert manager webhooks |
ansible.eda.servicenow | ITSM ticket events |
ansible.eda.pagerduty | Incident triggers |
ansible.eda.github | Repository webhooks |
ansible.eda.gitlab | CI/CD pipeline events |
ansible.eda.elastic | Log-based alerts |
ansible.eda.dynatrace | APM anomalies |
ansible.eda.datadog | Monitoring alerts |
ansible.eda.splunk | SIEM events |
Use Case: CVE Remediation
1. [Detect] Vulnerability scanner finds critical CVE
2. [Analyze] AI assesses: 47 hosts affected, 12 in production
3. [Decide] AI recommends: patch staging first, then rolling prod
4. [Approve] Platform team approves via Slack/Teams
5. [Execute] AAP patches staging → verifies → patches prod (serial: 25%)
6. [Verify] Post-patch scan confirms CVE resolved
7. [Report] ServiceNow ticket updated with resolution
Platform Requirements
- AAP 2.7+ with EDA Controller
- PostgreSQL 17
- Django 5.2 LTS
- Gateway-only architecture (new in 2.7)
- Minimum 3 worker nodes for HA
Best Practices
- Start with detection only — observe before automating
- Require approval for production — never skip human gates in prod
- Define blast radius limits — cap percentage of hosts affected per run
- Audit trail — every decision point logged with reasoning
- Gradual autonomy — expand auto-approval scope over time as trust builds
Conclusion
The Automation Orchestrator represents Red Hat's vision for autonomous IT operations: events trigger AI analysis, AI recommends action, humans approve critical changes, and AAP executes deterministically. Available Q3 2026 as part of AAP 2.7+.