Most teams judge their AI tools by feel. The data says feel is a terrible instrument.
The METR randomized trial from 2025 put 16 experienced open-source developers on 246 real tasks. With AI tools they were 19% slower. Afterwards they estimated AI had made them 20% faster. That is a 39 point gap between perception and reality.
The wider numbers point the same way. The DORA 2025 report found about 90% adoption, yet AI adoption is still associated with higher delivery instability. Stack Overflow 2025: 84% use AI, and 46% distrust its accuracy. Teams are using the tools heavily and trusting them only halfway, which is exactly where unchecked output sneaks into production.
The key idea
AI is not the problem. Unverified AI output is. A model produces things shaped like the real thing: a field from a newer release, an oc flag borrowed from another subcommand. It reads right and it fails on contact with the cluster. Worse, the time you “saved” gets quietly spent on debugging a fix that never had a chance of working, and that hidden cost is a likely reason the METR developers felt fast while the stopwatch said otherwise.
The fix comes from a DevOps engineer who works on OpenShift platforms for banks. Give the model a tight prompt, then make the cluster check the answer.
The model proposes, the environment decides.
Old way vs new way
Old way: paste an error, ask “what’s wrong?”, copy the YAML it hands back, apply it, and trust the feeling that you saved time. When it breaks, paste the new error and repeat. Each loop feels productive, but nobody is measuring the loops.
New way: give the model structured context, ask for ranked hypotheses with evidence, and run every generated artifact through real validators before it goes anywhere near an environment. You still get the speed of a first draft, but the verification is mechanical instead of emotional.
Where AI holds up:
- Reading logs, events and stack traces into ranked hypotheses
- Explaining inherited Helm charts, Jenkinsfiles or Terraform modules
- First drafts of jq, PromQL, regex and Bash
- Acting as a second reviewer on a diff
- Writing postmortems from chat exports
Where it does not: exact flags, CRD fields and API versions. Never take those on faith. A good rule of thumb is that the more precisely a detail depends on your exact version, the less you should trust the model’s memory of it.
Practical steps
Step 1: Build the prompt in 7 parts.
- Role and audience. “Senior engineer, skip the basics.”
- Environment with versions. This is the biggest single lever. Name the OpenShift version, the Helm version and the operator versions, not just “a Kubernetes cluster”.
- Task as an outcome. “Rank the 3 most likely causes” beats “look at this.”
- Evidence in tags such as
<events>and<logs>. For long inputs, put the data first and the question last. Anthropic’s docs say this can improve quality by up to 30% on complex multi-document inputs. - Constraints with the reason. “Prod in a bank: read-only, dry-run plus rollback for any change.”
- Output shape. “Each cause with the supporting log line and one read-only command to confirm.”
- An honesty clause. “If you’re not certain a flag or field exists in this version, say so instead of guessing.”
Save the finished prompt as a template in your team repo. Next incident, you only swap the evidence and the versions.
Step 2: Make the cluster check the answer.
- ✅
oc explain deployment.spec.strategy.rollingUpdateconfirms the field really exists - ✅
oc apply -f generated.yaml --dry-run=serverlets the API server judge it - ✅
oc diff -f generated.yamlshows exactly what would change helm template ./chart | kubeconform -strictvalidates rendered manifestsshellcheck generated.shcatches script mistakes
Run them cheapest first: lint, then schema, then server-side dry run, then diff. Better still, wire the same checks into your pipeline, so a hallucinated field gets rejected by CI instead of by a colleague at 2 a.m.
Step 3: Lock down your agents. If you use Claude Code, Codex CLI or MCP tools, use a read-only kubeconfig, keep approvals on for anything that mutates, and put standing instructions in CLAUDE.md or AGENTS.md. Treat logs and tickets as untrusted input, since they can carry injected instructions. Keep prod credentials off laptops.
Step 4: Respect your data rules. Consumer and business plans differ on training. Anthropic’s consumer terms since Aug 2025 allow training on Free, Pro and Max chats unless you opt out, while commercial terms are excluded. OpenAI says it does not train on business data. Redact tokens, hostnames and customer names before pasting, and treat redaction as a seatbelt, not a guarantee. When in doubt, check with your security team first.
Your move
Run your own small experiment. Pick a handful of routine tasks, do half with AI and half without, and time both. Write down your prediction before you start, then compare it with the stopwatch. If METR’s developers could be off by 39 points, your gut can be too.
The original author has a longer write-up with three reusable prompts and a small prompt builder at aib-devops.com. Try the 7-part structure this week, and tell the crew what your stopwatch says!
AI made experienced devs 19% slower while they felt 20% faster. What actually works for DevOps prompts (with verification)
by u/Personal-Ad2131 in PromptEngineering