CYBRARY Autonomy is a budget, not a switch
Mode ceilings, rate limits, blast-radius caps and approval gates are one budget spent across a run. State the ceiling before the incident, and the argument at 3am is about evidence rather than about permission.
A-230·AI safety·75 min
AI security capstone — autonomous triage under oversight Start this lab
The assistant triages the queue on its own overnight. Review what it did, catch the one action it should have stopped for, and rebuild the oversight boundary so the same shift is safe to repeat.
Mission brief · A-230
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
The capstone asks the question a security review will ask: can you let an agent work at speed and still bound what it can do wrong? Every earlier AI lab isolates one control; here they have to hold together under an incident where the fastest path and the safe path disagree.
Concepts
Oversight needs an audit trail a human can read
Every consequential action should trace to the input that justified it, the policy that allowed it and the human who cleared it. If the trail only proves what happened and not why it was permitted, the review will not be survivable.
Assume the agent is compromised and ask what it costs
Design the containment first: which credentials it holds, which tools it can reach, and how a session is revoked. The answer determines how much autonomy is defensible in the first place.
Objectives graded
- Audit an autonomous shift against its approval ceiling
- Correct a wrong machine verdict with human evidence
- Redraw the oversight boundary and defend it
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-a-230/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Attach evidence: ai/unapproved-actionactionThe action the agent took past its ceiling was identified and evidenced.
- 6.Attach evidence: range/hst-ai-agent01/sessionactionThe shift was reconstructed on the runner itself.
- 7.Write case field unapprovedToolactionunapprovedTool → endpoint.unisolate
- 8.Write case field unisolatedHostactionunisolatedHost → hst-fin-ws14
- 9.Write case field capstoneExfilBucketactioncapstoneExfilBucket → s3://nw-agent-scratch-pub
- 10.Write case field capstoneMirroractioncapstoneMirror → kb-community-mirror
- 11.isolated on hst-fin-ws14actionapproval gatehst-fin-ws14.isolated → true
- 12.Attach evidence: ai/oversight-debriefactionA debrief states which decisions the agent may keep and which return to a human.
- 13.Write case field segmentGatewayactionsegmentGateway → 10.42.48.1
- 14.Write case field seatRamGbactionseatRamGb → 16
- 15.Write case field seatDiskGbactionseatDiskGb → 512
Gate approved — 100%
20 of 20 rubric rules hold.
Gate denied — 86%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass safety · The action the agent took past its ceiling was identified and evidenced.
- pass investigation · The shift was reconstructed on the runner itself.
- pass investigation · The action that undid containment was named from the audit trail.
- pass investigation · The host whose containment was lifted was identified.
- pass configuration · The destination of the overnight export was evidenced from the gateway log.
- pass explanation · The debrief traces the agent's justification back to an unsigned catalog refresh.
- pass behavior · The host the agent mis-triaged as benign is isolated after human review.
- pass explanation · A debrief states which decisions the agent may keep and which return to a human.
- pass investigation · The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
- pass investigation · The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
- pass investigation · Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
MITRE ATT&CK coverage
An autonomous assistant closing cases is a defensive control; when it closes the wrong one, the impairment came from inside the SOC.
| Technique | Name | Tactic |
|---|---|---|
| T1204.001 | User Execution: Malicious Link | Execution |
| T1199 | Trusted Relationship | Initial Access |
| T1078.004 | Valid Accounts: Cloud Accounts | Defense Evasion |
| T1562.001 | Disable or Modify Tools | Defense Evasion |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The action the agent took past its ceiling was identified and evidenced.
safety · weight 25 · T1562.001 Disable or Modify Tools (Defense Evasion)
The shift was reconstructed on the runner itself.
investigation · weight 15
The action that undid containment was named from the audit trail.
investigation · weight 10
The host whose containment was lifted was identified.
investigation · weight 10
The destination of the overnight export was evidenced from the gateway log.
configuration · weight 10
The debrief traces the agent's justification back to an unsigned catalog refresh.
explanation · weight 10
The host the agent mis-triaged as benign is isolated after human review.
behavior · weight 20 · T1204.001 User Execution: Malicious Link (Execution)
A debrief states which decisions the agent may keep and which return to a human.
explanation · weight 20 · T1199 Trusted Relationship (Initial Access)
The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
investigation · weight 5
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Common mistakes
- Raising the ceiling under time pressure and not lowering it afterwards.
- Logging tool calls without logging the authorization decision.
- Proving the agent was right this time instead of proving it was bounded.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
| artifact | Indicator | Artifact | Record |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
What transfers
The oversight boundary you can describe — inputs, ceiling, approvals, revocation — is the one a regulator, an auditor and your own incident review can all use.