AI agents7 min read
Security triage agents: containment, SIEM spans, and kill switches before write remediations
A triage agent that can write remediations without containment, SIEM spans, or a kill switch turns a false positive into a self-inflicted incident.
- Classify every triage tool as read, propose, or write before raising autonomy.
- Bind principals, ACLs, run IDs, and SIEM spans so every action is reconstructable.
- Require human approval for access changes, isolation, and irreversible config writes.