Selecting an AI model for infrastructure operations requires evidence from the operational task it will perform. General reasoning capability is useful, but a model also needs to select appropriate tools, respect human decisions, inspect the resulting infrastructure state, and report what actually happened.
We compared five model configurations running the same DNS A record agent through Itential FlowAI. The recorded sequences exposed a difference that the final notification alone could not establish: the GPT OSS configuration omitted an expected post-creation verification call. The other four recorded sequences included it. Notification presentation and token usage also differed.
This guide explains how to use those observations in model selection. It describes the role of the FlowAI harness, examines the DNS results, and provides a repeatable evaluation protocol for customer workloads. The recorded results form the worked example; the protocol explains how to extend the evaluation.
Infrastructure teams do not select a model in isolation. They select a model configuration for a task performed through a specific set of tools, instructions, permissions, and infrastructure integrations. A configuration that works well for incident investigation may require different evidence before it is authorized to provision a service or perform rollback.
The useful question is therefore specific: can this model configuration perform this task, through this harness, while meeting the operational requirements? That question produces a testable contract. “Best model” without a task, environment, and acceptance criteria does not.
| Component | Role in the evaluation |
|---|---|
| Model configuration | The selected model, provider endpoint, settings, and any provider-specific behavior. This is the configuration being compared. |
| FlowAI harness | The tools, skills, context, governance, and execution environment through which model reasoning becomes action. |
| Configured agent | The operational goal, instructions, available capabilities, and boundaries used to exercise the model. |
| Execution evidence | Tool requests and responses, decisions, resulting state, notifications, and usage records used to assess the run. |
Changing the model within a shared harness is a practical comparison for a team deciding what to deploy. It is not a measurement of isolated model capability. Provider behavior, parameter support, tool interfaces, and context handling can influence the result. Record those differences rather than treating them as invisible implementation details.
Two experiments answer different questions. A shared-configuration experiment asks how models behave under the same task instructions and tool interfaces. A deployment-optimized experiment asks how well each model performs after documented configuration improvements. Both are useful. Report them separately so model-specific tuning is not mistaken for a controlled comparison.
The DNS comparison uses the same agent flow and task across providers. Its recorded configurations provide a starting point for investigation and retesting. The protocol later in this guide explains how to document settings, control initial state, and establish a reproducible comparison.
A model comparison within FlowAI and a comparison between harnesses answer different questions. Comparing harnesses requires equivalent task contracts, tools, control boundaries, and measurement methods.
FlowAI is the agent harness within the Itential Platform. Its architecture brings together tools, skills, context, and governance. Those components give model reasoning an operational setting: capabilities to invoke, task guidance to follow, state to inspect, and boundaries on permitted actions.
FlowAI supports compatible models through supported provider integrations. The Model Registry configures provider connections and enabled models; profiles are environment-specific. The registry documentation also describes model-specific variables for on-prem profiles. These capabilities make provider connection and parameter choices part of the reproducibility record.
For evaluation, this separation matters. A team can investigate a different model choice while retaining the operational task and existing automation capabilities. The comparison remains meaningful only when the versions and behavior of those capabilities are documented and controlled.
A tool provides a callable capability. A skill provides guidance about how to approach the task. A DNS lookup tool might return record state; task guidance might explain when to perform that lookup and what evidence to inspect before continuing. The tool interface and the guidance both affect what the model sees and how it selects its next action.
This distinction also improves diagnosis. A missing verification call may require clearer instructions, a more explicit tool description, a revised workflow design, or a different model configuration. An execution trace identifies the omission; it does not, by itself, identify the cause.
FlowAI operates within the platform’s governance and execution architecture. Authorized access to a tool and completion of every required task step are different properties. A model may use only authorized tools and still omit a required lookup. The DNS example makes this distinction concrete.
When a step is mandatory, define its enforcement in the operational design. For example, a workflow can require verification evidence before reporting an accepted outcome. Evaluate that control alongside the model’s tool-selection behavior.
A skill or prompt can explain the required process. Authorization and approval controls determine which actions are permitted. Acceptance checks determine whether the operational result meets the task contract. Each responsibility should have identifiable evidence.
FlowAI brings model flexibility, infrastructure integration, reusable automation, and execution visibility into the same operational environment. Teams can compare model choices against existing capabilities, inspect the resulting actions, and use the findings to improve the configuration.
An evaluation needs to distinguish performing an action from establishing its outcome. A successful tool response can show that a request was accepted or processed. The resulting infrastructure state may require a separate observation. An email that describes success is another representation of the run, not a substitute for either form of evidence.
| Dimension | Acceptance question | Evidence |
|---|---|---|
| Action adherence | Did required actions occur in the correct conditional order? | Trace, arguments, responses, and decision events. |
| State verification | Does observed state match the requirement for this branch? | Readback against the correct resource and relevant attributes. |
| Decisions and recovery | Did the run follow the approval, rejection, or recovery decision? | Decision record and subsequent actions. |
| Communication accuracy | Does the report agree with what occurred and what remains uncertain? | Final notification compared with trace and state evidence. |
| Presentation | Can the intended operator understand the result? | Separate rubric for structure, clarity, and necessary detail. |
| Operational efficiency | What resources were required to achieve an accepted result? | Billing, timing, retries, and human intervention. |
| Consistency | How often are the criteria met across the intended scenarios? | Repeated, independently recorded attempts. |
The correct tool name can still be called with the wrong zone, record, or parameters. A lookup can return an error or data that does not support the requested conclusion. Inspect the target, arguments, response, and interpretation of each required call rather than accepting the presence of a tool name as proof of correctness.
For a DNS change, the contract should identify the target zone, record name and type, address, and other relevant attributes. Define whether verification means inspecting the provider’s record state or testing resolution from a particular observation point. Those are different checks. The DNS comparison documents a second GETARECORDS call; it does not establish propagation behavior across resolvers.
Define mandatory pass/fail conditions before ranking presentation or efficiency. If a required verification step is absent, an attractive notification should not raise the run into the accepted category. Preserve separate scores so a reviewer can see the difference between a process failure and a preference about verbosity.
The source study compares five model configurations running the same DNS A record agent through FlowAI. The recorded branch includes provisioning followed by a provision-results decision and deletion of the record. The comparison focuses on tool-call sequence adherence, notification presentation, and reported token usage.
| Step | Action | Purpose |
|---|---|---|
| 1 | GETARECORDS | Inspect existing record state in the target zone. |
| 2 | DNS approval gate | Obtain the provisioning decision. |
| 3 | CREATEARECORD | Create the requested DNS A record. |
| 4 | GETARECORDS | Check the resulting state after creation. |
| 5 | DNS provision results | Obtain the decision about the provisioned result. |
| 6 | DELETEARECORD | Roll back by deleting the provisioned record. |
| 7 | MAILWITHOPTIONS | Notify the operator about the actions and outcome. |
This sequence describes the expected recorded branch, not every possible approval, rejection, or error branch. The source records six steps for GPT OSS and seven for the other configurations. The difference is the missing lookup between creation and the provision-results decision.
The sequence does not show an independent readback after deletion. A deletion response and independently verified absence of the record are different evidence. A broader protocol should define whether post-rollback verification is required and record it explicitly.
| Study label | Recorded model identifier |
|---|---|
| GPT OSS 120B | openai.gpt-oss-120b-1:0 |
| Gemma 4 31B | google/gemma-4-31b-it |
| Claude Sonnet 5.5 | claude-sonnet-5-5 |
| Nemotron Super-3 | nvidia/nemotron-3-super-120b-a12b |
| Nemotron Ultra-3 | nvidia/nemotron-3-ultra-550b-a55b |
| Configuration | Post-creation lookup | Email score | Assessment in the source study |
|---|---|---|---|
| GPT OSS 120B | Omitted | 3/5 | Concise and functional; limited formatting and context. |
| Gemma 4 31B | Included | 4/5 | Clear and balanced; less structured than the strongest result. |
| Claude Sonnet 5.5 | Included | 5/5 | Strongest presentation; organized parameters and timeline. |
| Nemotron Super-3 | Included | 4/5 | Detailed and traceable; more verbose than necessary. |
| Nemotron Ultra-3 | Included | 4/5 | Structured and traceable; comparable to Super-3, still verbose. |
The email scores reflect the source study’s qualitative presentation assessment. Keep presentation separate from factual accuracy and execution adherence when interpreting the results.
| Configuration | Input tokens | Output tokens | Total tokens |
|---|---|---|---|
| GPT OSS 120B | 18,682 | 2,420 | 21,102 |
| Gemma 4 31B | 27,558 | 1,177 | 28,735 |
| Claude Sonnet 5.5 | 45,871 | 3,079 | 48,950 |
| Nemotron Super-3 | 35,916 | 4,077 | 39,993 |
| Nemotron Ultra-3 | 37,260 | 2,995 | 40,255 |
Reported usage ranges from 21,102 to 48,950 tokens. Each total is the sum of input and output tokens. Actual cost and elapsed time require separate measurement.
These results describe the documented runs. Attempt counts and variation across repeated tests are not supplied, so the four sequences containing verification should not be interpreted as a reliability rate.
Choose a configuration against the workload’s requirements. Assess mandatory adherence, communication quality, cost, elapsed time, and consistency separately before making the deployment decision.
The GPT OSS trace proceeds from creation to the provision-results decision without the second GETARECORDS call. This establishes an omission in the documented sequence. It does not establish that the model always omits verification, that the record was created incorrectly, or that the final email contained false statements.
The next investigation should examine the instructions, the verification tool description, the creation response, and the model’s subsequent tool selection. Retest the original configuration before changing it. Then change one relevant factor at a time and record the effect. Otherwise, improvements cannot be attributed to a particular configuration change.
The study’s notification assessments capture readability, structure, and verbosity. A broader evaluation should also inspect whether the message identifies the actual human decision, distinguishes creation from verification, describes rollback accurately, and states any unresolved uncertainty.
A useful notification can report an incomplete run honestly. Conversely, a well-formatted message can overstate what the evidence supports. Grade those cases differently. Presentation should help the operator understand the evidence; it should not obscure missing evidence.
The lowest-usage configuration also omitted verification. The highest-usage configuration received the strongest presentation assessment. Neither association establishes causality. The available record cannot show how much usage came from the verification step, reasoning, tool output, conversation history, or other provider behavior.
Cross-model tokens are also not a common unit of identical work. Tokenization and billing conventions can differ. Treat the counts as provider-reported consumption and reconcile them with pricing and measurement scope before drawing cost conclusions. The decision-relevant metric is the resource required to achieve accepted operational results, including unsuccessful attempts.
If a required check can be skipped, model choice is only one response. A team can also make the check explicit in task guidance, improve the relevant tool contract, or place it within an execution path that requires evidence before the task is accepted. Those changes must be tested rather than assumed to resolve the issue.
This is why the harness belongs in the evaluation. It provides an operational setting in which a team can observe behavior and refine the configuration. The study demonstrates differences within FlowAI; it does not measure FlowAI’s relative effectiveness against another harness.
Use the following protocol to extend the DNS example into a repeatable comparison for your infrastructure workloads.
Specify the requested resource, permitted actions, required evidence, branch decisions, stopping conditions, and final reporting requirements. Define the acceptable terminal state for each branch. For provision-and-retain, the record should match the request. For rollback, the expected state may be absence of the newly created record while preserving any pre-existing records.
Use a controlled environment and restore the intended initial state between attempts. Record pre-existing resources and generated identifiers. A cleanup action must target the resource created by that attempt, rather than assume every matching name is safe to delete.
| Record group | Fields to retain |
|---|---|
| Model and connection | Exact identifier, provider, endpoint or deployment, profile revision, and test date. |
| Generation settings | Supported sampling, token, timeout, reasoning, and other parameters; omitted values and known defaults. |
| Agent and harness | FlowAI and platform versions, agent revision, instructions, skills, context policy, and tool schemas. |
| Execution controls | Tool scope, permissions, approval behavior, mandatory checks, retry rules, and termination policy. |
| Scenario | Initial state, request data, operator decisions, injected failures, and reset procedure. |
| Evidence | Run ID, trace, responses, independent state checks, notification, usage, timing, and assessment. |
Do not assume the same numeric setting has identical meaning across providers. Unsupported settings, provider defaults, and request transformations belong in the record. A model comparison is reproducible only to the extent that these dependencies are visible.
OpenTelemetry (OTel) is an open-source, vendor-neutral observability framework and a Cloud Native Computing Foundation (CNCF) project. Formed through the merger of OpenTracing and OpenCensus, it provides tools, APIs, and SDKs for generating, collecting, and exporting traces, metrics, and logs.
Where instrumentation is available, teams can use OpenTelemetry to correlate model requests, tool execution, errors, and timing across an evaluation run. Associate telemetry with the run identifier and model configuration so reviewers can connect resource measurements to the actions performed.
Telemetry supports the evaluation record. Acceptance criteria and infrastructure state checks still determine whether the intended operational outcome was achieved.
Begin with provisioning and retention, rejection before provisioning, provisioning followed by rollback, creation failure, and verification mismatch or failure. Add malformed inputs, pre-existing records, ambiguous tool responses, and interrupted approvals where relevant. Each scenario needs its own expected actions and state contract.
For example, rejection before provisioning should not lead to creation. A failed verification should not be represented as a verified success. Define recovery behavior in advance so the assessor is not inventing the expected response after seeing the model’s output.
Run each candidate across the planned scenarios multiple times, using fresh sessions when the deployment contract requires them. Retain unsuccessful, interrupted, and timed-out attempts. Document exclusions and their reasons. Vary execution order where practical so transient provider or infrastructure conditions do not systematically favor one configuration.
Choose repetition counts based on the reliability question and workload risk. Report the number of attempts per scenario, accepted attempts, and observed failure categories. A small number of successful runs should not be described as proof of rare-failure behavior.
Use pass, fail, and inconclusive where appropriate. If no independent state observation is available, “verified outcome” may be inconclusive rather than pass. Record the operational consequence separately: safe stop, rejected request, unsupported success claim, or unintended action.
Where a qualitative notification score is used, define anchored criteria for structure, required fields, clarity, and verbosity. Assess factual accuracy against the execution record separately. Use more than one reviewer when the intended claim depends on consistent subjective assessment, and retain disagreements.
| Metric | Suggested definition |
|---|---|
| Operational acceptance | Attempts meeting every mandatory criterion divided by all eligible attempts; report inconclusive attempts separately. |
| Verification adherence | Required checks completed correctly divided by applicable check opportunities. |
| Communication accuracy | Reports meeting the factual criteria divided by evaluated reports; disclose missing reports. |
| Cost per accepted outcome | Total measured cost of eligible attempts, including failures, divided by accepted outcomes. |
| Elapsed time | Start to terminal outcome, with provider, tool, queue, and approval wait time distinguished where measurable. |
| Intervention burden | Human corrections, escalations, and recovery work per attempt or accepted outcome, with the chosen unit explicit. |
If no outcomes are accepted, cost per accepted outcome is undefined. Do not hide failed attempts by calculating cost only from successful runs. Planned approval time should be reported separately from unplanned corrective work; they represent different operational requirements.
Reconcile token billing with applicable input/output rates, cached usage, other billed categories, and hosting costs. Record concurrency and infrastructure conditions when timing runs. Use distributions and scenario-level results where repeated data supports them, rather than a single average that conceals failures or long-tail delays.
When OpenTelemetry instrumentation is available, use correlated traces to distinguish model-request latency, tool execution, and other instrumented stages. Record sampling and instrumentation coverage alongside the results so missing telemetry is not mistaken for a missing action. Reconcile telemetry with provider usage records and the operational execution record.
Start with the mandatory criteria. A configuration that fails a required action, violates a decision boundary, or claims verification without supporting evidence needs investigation before production acceptance. Presentation and consumption can differentiate configurations only after the operational requirements are addressed.
A troubleshooting workflow may value breadth of investigation and clear evidence-backed recommendations. A provisioning workflow may place greater weight on argument correctness, approval behavior, and state verification. A high-volume routine workflow may make cost and elapsed time important once adherence and consistency meet the required threshold.
Keep scenario-level results visible. A strong overall average can conceal failure on the branch that carries the greatest operational risk. Explain why a chosen configuration is suitable for the authorized workload and which scenarios remain outside its evaluated scope.
The broader architectural opportunity is to reuse the capabilities and knowledge already present in the environment. Existing workflows provide operational actions. Skills and instructions guide their use. Infrastructure systems provide state and context. Execution controls govern the permitted path. Model choice can then evolve within that documented operational design.
Model flexibility has practical value when it enables retesting and substitution without discarding established infrastructure integrations and automation. It also creates a maintenance responsibility: the approved configuration must be identifiable, and material changes must trigger evaluation.
Retest after changing the model, provider deployment, instructions, skills, tool schemas, context handling, or required execution controls. Define an owner for the accepted configuration, retain the previous test record, and document what evidence is needed to authorize the new revision.
Our DNS comparison gives model selection a concrete operational basis. Five configurations performed the same task within FlowAI. Their documented runs differed in verification adherence, notification presentation, and token consumption. Inspecting execution exposed a missing step that a usable final response alone did not establish.
The next step is to expand that evidence through controlled scenarios, repeated attempts, explicit scoring, and actual efficiency measurements. This produces a model choice tied to the work a team intends to authorize, rather than a ranking detached from the operational environment.
FlowAI provides the harness for putting that choice into practice: compatible model integrations, infrastructure tools, task guidance, and governed execution within the Itential Platform. Bring your infrastructure use case to the Itential team. We can define the required actions and evidence, then evaluate candidate configurations against those requirements.
The comparison evaluates model configurations operating within FlowAI. The configured agent exercises each model, and its execution provides the evidence. Comparing different harnesses would require a separate experiment.
The source provides separate observations rather than an overall score. Four recorded configurations included the expected post-creation lookup. Claude Sonnet received the highest notification presentation assessment. Overall suitability requires a workload-specific decision rule and additional consistency and efficiency evidence.
No. It establishes that the documented sequence omitted an expected verification action. Whether the record was created correctly requires state evidence. Whether the omission repeats requires further attempts.
A tool response and observed resource state answer different questions. Define the observation required by the contract. For DNS, reading provider record state and confirming resolver propagation are different tests and should not be treated as interchangeable.
No. The source does not document attempt counts or result distributions. Those sequences identify observed behavior. Repeated testing across a stated scenario set is needed before reporting acceptance rates or consistency.
Tool authorization, approval enforcement, and task completeness are separate properties. Define where each mandatory action is enforced, inspect the relevant evidence, and test what happens when it is absent. The omitted lookup shows why task completeness needs its own acceptance checks.
It records consumption for the documented configurations. It does not establish billed cost, speed, or efficiency. For a deployment decision, reconcile usage and billing across all eligible attempts and assess resource consumption per accepted operational outcome.
Report an untuned shared-configuration comparison separately from a documented deployment-optimized comparison. Version every change. Otherwise, differences in instructions or settings may be attributed incorrectly to the model alone.
See how Itential connects AI reasoning to governed execution across your entire infrastructure.