Incident Response · Agent Tool Layer

Read = Autonomous  ·  Write = Human, Always

Agent
Soc_Agent_v4
UNAWARE OF GAP
Tool Layer
STEP 1 / 5
Read · autonomous✓ ALLOWED
get_recent_incidents() auto
lookup_entity(entity_id) auto
search_incidents(query) auto
Write · human-gatedNO FUNCTION
request_containment(host_id) —
Definition not found.
no isolate_host()  ·  no disable_account()
no kill_process()  ·  no firewall_block()
Return value
request_containment →
ACTION_REQUIRES_APPROVAL
logged to pending-approvals.jsonl
nothing was isolated.
nothing was touched.
● READ = AUTONOMOUS // ● WRITE = HUMAN, ALWAYS