Oncology taught healthcare a discipline most of the technology world still lacks: the post-operative report states, in writing, what was removed and — more importantly — what remains and where. Nobody discharges a patient on the strength of the resection alone. NoOps deserves the same honesty. The term promises that buying managed services and writing automation can shrink an operations department down to nothing, and in fair cases the shrinkage is real. What never gets said loudly enough is what survives the excision. This article is that pathology report: nine duties that remain on the chart after even the most thorough automation programme, each described precisely enough that you can audit your own plan against it.
First, What NoOps Genuinely Retires
Credit where due, because fairness sharpens the list that follows. Moving to managed platforms genuinely retires real work. The retired items include, at minimum:
- racking and cabling physical servers, and decommissioning them;
- applying vendor patches to operating systems by hand, on a calendar nobody chose;
- forecasting hardware refresh cycles and arguing the capital case each year;
- sitting through midnight failovers for somebody else’s database engine.
The respectable version of the no-operations ambition — the one analysts have debated since 2011, and the one serious practitioners treat as a direction rather than a destination — simply notes that such chores can be purchased. The nine duties below are the ones no contract transfers. They are numbered for reference, not for priority; on a bad week, any one of them can outrank the rest.
The Nine Duties That Stay on the Chart
Each item below meets two tests: it survived contact with a real automation programme, and it appears on no vendor’s invoice. Readers from clinical backgrounds will recognise the genre — it is the operations equivalent of the follow-up schedule that outlasts every successful treatment.
1. Custody of the data itself
Every service model, from raw virtual machines to the most hands-off managed offering, leaves one item with the customer: the data and the judgements about it. Microsoft’s responsibility table has said this for years, and the leading cloud providers repeat it in plainer words — Amazon’s own documentation insists that a backup strategy belongs to the account holder no matter how managed the database is. Believing otherwise is how teams discover that a fully managed service replicated their mistake faithfully across every region. A test worth stealing from disciplined shops: a restore counts as ready only if someone has rehearsed it inside the last ninety days, and the rehearsal is written down.
2. Credential hygiene
The intrusion campaign that swept through one data-warehouse provider’s customer base did not defeat the platform. It defeated accounts: sign-ins without a second factor, credentials nobody had rotated, and no allow lists anywhere. “NoOps by announcement” never touches this duty, because it was never the ops department’s alone to begin with. Somebody on your side must own the question “which of our accounts could be entered tonight, and what would that cost us”.
3. Configuration decisions
Defaults are opinions the vendor wrote in advance. Someone in your organisation still decides retention windows, encryption scope, region placement, logging verbosity and a hundred quieter settings whose wrong values surface months later as breaches, bill shocks or forensic dead ends. Ask any team that has paid for a year of logs nobody read, or lost a compliance audit to a retention field left at its installation value. Automation can enforce a choice; it cannot supply the choice, and it never explains why the choice was made when a regulator asks two winters later.
4. Access policy
Who may do what, to which system, on whose approval — this is an organisational statement, not a technical one. Providers will cheerfully enforce whatever you write; none of them will write it for you. In regulated healthcare-adjacent businesses this duty carries legal weight, and delegating it to a dashboard’s default role tree is an abdication with an audit trail. The quiet test is seasonal: when someone joins, changes role, or leaves, how many minutes pass before their access matches their duties, and who is accountable for that interval?
5. Dependency arithmetic
Availability composes by multiplication. String together three components advertising 99.95, 99.95 and 99.99 percent, and your service inherits roughly 99.89 — weaker than its weakest link, however impressive the brochures looked side by side. No vendor’s agreement can lift your system above what its necessary parts permit, which is why provider promises must never be copied into your own objectives unmodified. The arithmetic is a minute of multiplication; skipping it is a quarter of explaining.
6. Capacity and quota headroom
Managed platforms still impose limits — requests per second, concurrent executions, account quotas — and riding against them produces outages that look like bugs and behave like walls. A healthy practice tracks headroom as a simple ratio of one minus peak-over-quota, reviewed on a schedule, with alarms set well before the ceiling. The failure it prevents has a signature worth memorising: the system that handled last year’s peak gracefully collapses at this year’s slightly larger peak, and everyone studies application code when the answer was an account limit nobody had read. Buying operations does not buy foresight; somebody still has to watch the gauges the vendor chose not to watch for you.
7. Money, counted honestly
The unit economics deserve more respect than they usually get. One worked example that circulates in the field priced a service at 177.6 per million requests, and found about two thirds of that figure was people time — coordination, investigation, toil that no invoice itemises but every payroll does. A “no ops” plan that lowers the platform line while scattering the same hours across product engineers has not saved money; it has re-labelled it. FinOps teams exist precisely to keep this arithmetic from lying.
8. Incident judgment
The 2026 wave of operations agents — Amazon put its DevOps Agent into general availability this March; Microsoft fields an SRE equivalent — genuinely shortens investigation, and that is worth having. But the makers themselves counsel that a human stays in the loop on live incidents, and it is not caution for its own sake. An agent proposes; accountability cannot. Investigations getting shorter is a genuine saving, while accountability getting shorter is a liability that auditors eventually invoice. Someone must own each agent’s permissions, and someone must own its mistakes, or the first autonomously executed wrong fix will teach your organisation what unowned write access means.
9. Exit readiness
Every arrangement ends, some on your schedule and some on the vendor’s. Google’s IoT Core shutdown in 2023 retired a managed offering and left its users migrating on someone else’s timetable — the classic unpriced exit. The discipline is dull and lifesaving: keep an estimate of what departure would cost, refresh it quarterly, and let regulation help where it can. From January 2027 the EU Data Act prohibits switching and egress charges for cloud customers, which shrinks the invoice of leaving while leaving untouched the engineering effort of actually moving.
NoOps Is a Reshuffle, Not a Discharge
Set the nine duties side by side and a pattern emerges: none of them is server babysitting. They are judgement, custody, arithmetic and accountability — precisely the work that resists purchase because it presupposes a stake in the outcome. Operations does not vanish under a successful automation programme; it climbs the stack and changes costumes. Teams that grasp this finish with something rarer than the slogan guaranteed: a smaller department, a counted residue, and no confusion about who answers when the residue misbehaves. Teams that miss the point simply meet the nine duties without a roster, usually at three in the morning. For the term’s full biography — its combative birth, the serverless detour, the honest limits — the Ops Atlas entry on NoOps belongs on the same shelf as this list.
Readers building their understanding of modern operations may also find two of our earlier pieces useful companions: an orientation to what XOps is and its core disciplines, which maps the family of “-ops” terms this article quietly draws on, and our guide to the FinOps roadmap for cloud cost optimisation, which takes duty number seven much deeper. Between the three of them, the residue has nowhere left to hide.