A security team automated log filtering with an AI agent that dropped volume 40% and cut costs, but six months later found the agent had been quietly deprioritizing DNS resolution logs from a subset of endpoints. The post outlines five security data decisions where AI should assist rather than own the outcome.