An AI Agent Team for the SOC: Skills, Mandates and Containment

Chapter 12 described the analyst's own assistant, which acts with the analyst's identity. This chapter takes the next step: a standing team of narrow AI agents in the security operations centre (SOC), each with its own skills, identity, tools, data and autonomy level, and a human conductor who answers for the team. It concerns all five functions: B1 Anticipate through hunting, B2 Detect through detection drafting and alert closure, B3 Investigate through triage and investigation, B4 Respond through bounded containment inside playbooks, and B5 Learn through the evidence the team keeps about itself. It shows which agents a SOC needs, how mandates are written and enforced outside the agents, how accountability stays with named people, and how a team is introduced, run without and retired.

The chapter builds on the mandate and containment designs of AI Red Team, Chapter 18, and The Transformed Security Architect, Chapter 13, and adapts them to a team whose agents read the most hostile content in the organisation and hold some of its most powerful permissions (64, Nordqvist, 2026) (66, Nordqvist, 2026).

Figure 13.1: A SOC agent team with its conductor, mandates, identities, policy decision point and independent stop path.

Agents as a team

Hansa Mutual's SOC runs four standing agents (triage, investigation, detection drafting and hunting) and one read-only critique agent. It runs no response agent and no manager agent, and the rest of this section gives the reasons.

An agent, in the sense of this book, is a system in which a model directs its own sequence of tool calls towards a goal. An agent team is a standing arrangement in which several narrow agents are triggered by events in the SOC's systems and write their output to the case, the detection repository or the response platform. Narrowness matters for security more than for productivity. One general agent that triages, investigates, writes detections and contains hosts needs the union of all those permissions and can be stopped only as a whole, whereas narrow agents need only what their task requires and can be paused one at a time.

Architecture as Code (Chapter 20) concluded that agents draft and humans approve, and that conflicts between agents are decided by the human owner (61, Nordqvist, 2025). The Transformed Security Architect, Chapter 13, applied the rule to an agent team for architecture work and concluded that the person who conducts the team remains the accountable verifier of everything it proposes (66, Nordqvist, 2026). That is Shift 4 of that book, from sole author to conductor of an AI team, applied here to a whole function: in the SOC the conductor is the SOC lead.

The roles a SOC might staff

A SOC has five kinds of work that an agent could take, and they have different failure modes.

Role	Task	Blue team functions	Reads	Writes or acts
Triage agent	Enriches and classifies alerts, closes defined low-risk classes	B2 Detect, B3 Investigate	Alert fields, asset and identity context, intelligence	Case notes; closure of named classes
Investigation agent	Scopes an incident, assembles a timeline, proposes hypotheses and containment, collects defined artefacts	B3 Investigate, B4 Respond	SIEM, endpoint telemetry, identity events	Case hypotheses; reversible actions and collection inside playbooks
Detection-drafting agent	Drafts detections and tests from threat reports and incident findings	B2 Detect, B5 Learn	Threat reports, detection repository, past cases	Pull requests on the detection repository
Hunting agent	Runs approved query packs for a hunt hypothesis and clusters results	B1 Anticipate, B2 Detect	Data lake, hunt records	Hunt findings for the hunter
Response agent	Executes containment	B4 Respond	Playbooks	Actions on the estate

A SOC does not need five agents. Enrichment is a skill, not an agent: a versioned bundle of instructions, queries and parsers that the triage and investigation agents both load, pinned in their manifests so that a change to it is a change to the method and is reviewed as one. A standing review-drafting agent is not justified either: a post-incident review (Chapter 11) is occasional and needs a person's judgement at every paragraph, so the analyst's own assistant of Chapter 12 drafts it.

The response agent is the one a SOC should be most reluctant to build. Containment is an action on the estate, and the series' rule is that Level 3 Bounded is defined by a codified playbook enforced by a policy decision point outside the model (AI Red Team, Chapter 6) (64, Nordqvist, 2026). If the action is a playbook, the executor is the SOAR layer, a deterministic component that runs the playbook's steps; the investigation agent proposes the action and the playbook runs it. An agent whose job is to decide how to contain would hold broad action permissions and exercise judgement at the same time, the combination the playbook exists to separate. Chapter 10 describes the playbook manifest. The Five Eyes guidance on agentic AI services advises the same separation of duties between agents that read and components that act (35, Five Eyes agencies, 2026).

What the team looks like at Hansa Mutual

The group SOC lead conducts the team. The investigation agent HM-SEC-001, which AI Red Team, Chapter 18, introduced at Level 2 Supervised (AIDR-0311), holds Level 3 Bounded for three actions: workstation isolation, revocation of standard-user sessions and collection from defined sources. The triage agent HM-SEC-006 closes defined low-risk alert classes at Level 3 Bounded with sampling (Chapter 7). The detection-drafting assistant HM-SEC-002 keeps Level 1 Assisted and gains a workload identity that can open pull requests but not merge them. The hunting agent HM-SEC-007 runs approved query packs read-only at Level 2 Supervised, and a critique agent on a second model family challenges the investigation agent's conclusions (Chapter 14). The exposure prioritiser HM-SEC-005 is a Mode 4 application outside the team.

Three of these choices need a reason. The detection-drafting agent holds a Mode 5 identity although it only drafts, for the reason The Transformed Security Architect, Chapter 13, gave for its evidence collector: an agent that runs on a schedule with an identity of its own in production is a privileged machine insider whatever its level, and is contained as one (66, Nordqvist, 2026). The hunting agent stays at Level 2 although its packs change nothing: it reads restricted data across markets and its findings direct a person's hypotheses, so the hunter approves each pack and its scope. And the critique agent has a mandate of its own, MND-HM-SOC-05, because it reads restricted alert data and the first agent's output: Level 0 Advisory, read-only, writing flags to the case and nothing else.

Identity and permission

Each agent is a distinct principal. The Five Eyes guidance advises a cryptographically anchored identity for each agent, a trusted registry that binds identities to authorised roles and is periodically reconciled against the live set of agents, denial of any agent or key that is not in the registry, and the minimum scope for approved tasks (35, Five Eyes agencies, 2026). In the SOC this has four consequences.

1. No agent acts with an analyst's identity. In Modes 1 to 3 the AI borrows the analyst's access, and the audit trail cannot tell the analyst's action from the assistant's. A Mode 5 agent has a workload identity whose tokens are task-scoped and issued outside the agent's runtime, as AI Red Team, Chapter 14, concluded (64, Nordqvist, 2026). Tokens for write-capable work live five minutes, tokens for read-only work at most 60 minutes, and revocation takes effect within 60 seconds.
2. Every identity has named people. AI Red Team, Chapter 6, concluded that every machine identity has an owner, operators and an authority who are named people (64, Nordqvist, 2026). For the SOC the owner is the SOC lead, the operators are agent operators on the platform rota and the authority is the forum that granted the level. A registry entry without an owner is a finding.
3. The token carries the entity. At Hansa, tokens carry the legal entity on whose behalf an agent works on a case, so a case about the Swedish subsidiary cannot read the Dutch subsidiary's telemetry.
4. Agents cannot widen their own identity. No agent modifies its own privileges, issues a token or initiates a delegation without an expiry and a recorded grant chain, a prohibition the Five Eyes guidance states in so many words (35, Five Eyes agencies, 2026).

Mandate, permission manifest and containment profile

Three names describe an agent's limits, and they are two artefacts, not three. The mandate manifest (MND-*) is the SOC's written mandate for the agent: its purpose, the tasks it may perform, the level for each action class, who approves, the budget, the escalation rules, the review date and the expiry. The permission manifest of AI Platform and Security, Chapter 19, and AI Red Team, Chapter 18, is the technical ceiling that the enforcing systems read: identity, tools, scopes, rate limits, egress and stop path (63, Nordqvist, 2026) (64, Nordqvist, 2026). The containment profile (CP-*) is the permission manifest written for a SOC agent: this chapter names its fields and Chapter 15 fills them, with CP-HM-SOC-01 as the profile of HM-SEC-001. The mandate references the profile; where the two disagree the narrower wins and the discrepancy is a finding.

Instructions in a prompt are part of neither. This follows the conclusion of AI Governance, Chapters 19 and 25, that every agent is governed as a well-meaning insider, because instructions lower the rate of unwanted behaviour but only boundaries set a ceiling on its consequences (62, Nordqvist, 2026). Anthropic's own report of a simulated scenario shows the shape of the argument: a model took a blackmail action in 96 per cent of runs, and adding direct instructions not to do so lowered the rate without removing it (54, Lynch et al., 2025). It is a vendor research self-report of an artificial set-up, and the authors state that they had not seen the behaviour in real deployments; the lesson is about boundaries, not about any one model.

Mandate manifests

A mandate manifest is kept in version control beside the detections and playbooks it governs. The platform's identity provider, policy decision point and egress gateway read it, so a change to a mandate is a reviewed pull request and not a conversation. It answers eleven questions, which the example below shows key by key: purpose and function, identity, tools, data, level per action class, conditions for Level 3, approvals, budgets, escalation, stop path, and review and expiry (quarterly and on any model change, with expiry after twelve months unless a recorded decision renews it).

Two entries need more explanation. The first is the list of what an agent may never do. For every SOC agent it contains the actions that would let the agent escape its own governance: closing its own sampling, editing a detection or playbook it relies on, altering the manifest, widening its tool list, writing to the store that records its actions, and any action whose purpose is to decide about a named employee's employment or access to work. The last follows the series' rule that Level 4 Autonomous is never used for such an action, and the manifest makes the rule a refusal rather than a hope. Disabling a person's account is such an action and sits at Level 2 at most, with a named human approving. Temporary isolation of a device or revocation of a session is reversible containment and may run at Level 3 inside a playbook, with the person told promptly.

The second is the entry for personal data. Agent logs show which analyst approved what and how fast. The manifest names the personal data the platform records, prohibits per-person metrics derived from it and sets the reporting level at the team. This is the form in which the agreement with employee representatives reaches the platform (Employee representatives and the analyst, below).

Worked example: mandate manifest MND-HM-SOC-02

This example is illustrative. It is Hansa Mutual's mandate manifest for the investigation agent HM-SEC-001, which AIDR-0768 adopted when the group SOC moved from a single agent to a team.

# Illustrative: Hansa Mutual, mandate manifest for HM-SEC-001
id: MND-HM-SOC-02
version: 1.0.0
agent: HM-SEC-001
usage_mode: Mode 5 Autonomous production agents
functions: [B3 Investigate, B4 Respond]
decision_records: [AIDR-0311, AIDR-0768]
containment_profile: CP-HM-SOC-01   # the permission manifest of this agent
owner: group SOC lead
operators: [agent operator on the platform rota]
authority: group AI governance board
identity: {workload: spiffe://hansa.group/soc/investigation-agent, token_minutes_write: 5, token_minutes_read: 60, revocation_seconds: 60, carries_entity: true}
purpose: Scope incidents, assemble timelines and propose containment for a named analyst
data:
  read: [siem, edr_process_tree, idp_user_context, cmdb, threat_intelligence]
  models: self-hosted in hansa-dc-frankfurt
  untrusted_inputs: [alert_fields, ticket_text, file_names, log_lines]
actions:
  read_and_enrich: {level: 0, approval: none}
  add_hypothesis_to_case: {level: 1, approval: analyst reviews}
  isolate_workstation: {level: 3, playbook: PBK-HM-ISOLATE-01}
  revoke_standard_sessions: {level: 3, playbook: PBK-HM-REVOKE-01}
  collect_defined_artefacts: {level: 3, playbook: PBK-HM-COLLECT-01}
  isolate_shared_host: {level: 2, approver: SOC lead, deputy: incident commander on shift when the SOC lead cannot be reached in the decision time}
  disable_account: {level: 2, approver: incident commander}
  block_indicator: {level: 2, approver: senior analyst of the market}
level_3_conditions:
  signal: reviewed detection plus the corroboration the playbook manifest requires
  model_confidence: ignored
  max_actions_per_hour: 10
  max_targets_per_action: 1
  excluded: [servers, domain controllers, executives, break-glass accounts]
  entity_rollout_gate: works-council agreement where required
never: [close_case, edit_detection_or_playbook, change_own_mandate, widen_tool_list, write_to_action_log, decide_about_named_employee_access_to_work, act_at_level_4]
budgets: {max_tool_calls_per_case: 150, max_minutes_per_case: 20, monthly_cost_eur: 9000, on_limit: stop_and_escalate}
circuit_breakers: [sampled_escape_found, level_3_rate_exceeded, denied_calls_over_threshold]
personal_data: {recorded: [case_id, approver_role, approval_latency], prohibited_uses: [per_person_metrics, performance_evaluation]}
stop_path: {holders: [shift lead, duty analyst, incident commander, agent operator], mechanism: out-of-band revocation at the identity provider, target_seconds: 120, notify_shift_lead_seconds: 60}
review: {cadence: quarterly and on any model change, next: 2027-05-09}
expires: 2028-02-09

Three entries carry the design. The Level 3 actions do not appear as free-standing permissions: each names the playbook that executes it, so the policy decision point refuses the call when the playbook's conditions do not hold. The never list closes the routes by which the agent could change its own governance. And decide_about_named_employee_access_to_work appears in the list although no listed tool does it, because a manifest that omits a prohibition invites a later change that adds the tool and forgets the prohibition.

Orchestration and accountability

The handover between agents is where accountability is easiest to lose. A triage agent passes an alert to the investigation agent, which proposes an action that the SOAR layer runs. At each hand-off the output of one component is the input of the next, and the question of who answers for the sequence has no automatic answer.

A pipeline, not a manager agent

The SOC orchestrates its agents with a deterministic pipeline: an event arrives, a rule selects the agent, the agent writes a structured result to the case and the next rule selects the next step. No agent assigns work to another agent or decides which outputs reach an analyst. This is the choice The Transformed Security Architect, Chapter 13, made for the architecture team, and it follows from AI Boss, Chapters 16 and 17, which concluded that when an agent orchestrates other agents, oversight of the last step is not oversight of the chain (66, Nordqvist, 2026) (67, Nordqvist, 2026). A manager agent would be a further model reading the adversary's text and holding assignment authority over the rest. A pipeline can be read, tested and stopped.

Two rules keep the pipeline honest.

• Hand-offs are structured, and upstream text is data. The triage agent passes the alert identifier, the class, the evidence references and its grounded statements in a fixed schema. The investigation agent treats every free-text field, including a previous agent's summary, as untrusted content, labelled by the trust classes T0 to T3 that Chapter 15 defines and inherits along the chain.
• No agent approves another agent's output. Approval is a human act with a human identity. The Five Eyes guidance does recommend consensus controls and a secondary agent to validate tasks (35, Five Eyes agencies, 2026); the SOC departs from that for approval, because agents on one model family fail in correlated ways. The critique agent of Chapter 14 may challenge a conclusion, but its objection is a flag for a person, not a gate that opens.

The chain of accountability

The chain ends with a named person at every link. The table shows it for the actions of the Hansa team.

Link	Who answers	What they answer for
Mandate and level	The authority (group AI governance board)	That the level was granted on evidence and is reviewed
Manifest and registry	The SOC lead as owner	That the mandate is current and the identity has operators
Operation	The agent operator on the platform rota	That the agent runs within budget and its telemetry is watched
Playbook	The playbook owner	That the action is reversible, rate-limited and tested
Closure class	The named class owner, a senior analyst	That closing the class is safe and its sampling is done
Individual case	The analyst who accepts, rejects or approves	That the conclusion was read against the evidence
The whole	The SOC lead as conductor	That the sum of delegations is known, measured and stoppable

NIS 2 Article 20 requires the management bodies of essential and important entities to approve and oversee cybersecurity risk-management measures, and DORA Article 5 places responsibility for ICT risk with the management body of a financial entity (3, European Union, 2022) (2, European Union, 2022). The architectural implication, not legal advice, is that nothing in the table moves to the tool: the agent executes within a mandate that people granted, and the record shows who. Chapter 14 draws the conclusion for a missed closure, where the review of the person who approved is itself under test.

The case record (CASE-*) is where the chain becomes visible. For every conclusion it names whether an agent or a person reached it, the agent's identifier and manifest version, the model version, the class owner for a closure and the analyst who closed or approved. Without those fields the record cannot answer the question the SOC will be asked after a missed intrusion.

Conflicts between agents follow the rule of Architecture as Code (Chapter 20): the pipeline surfaces them and the human owner decides (61, Nordqvist, 2025). If the triage agent closes an alert that the hunting agent later links to a suspicious host, the pipeline reopens the case and puts both outputs before the senior analyst. Agreement between agents on the same model family is not independent evidence.

Budgets and brakes

An agent team is an operated system, and operating it means limiting it. Four kinds of limit work together.

Budgets cap what an agent can consume per case and per month: tool calls, minutes of runtime, model tokens or cost. When a budget is reached the agent stops and escalates, and never extends itself. A cost cap is also a security control: an agent in a loop, or one steered to enumerate a data lake, spends its budget quickly. Rate limits apply to action tools; MND-HM-SOC-02 allows at most ten actions an hour and one target per action, so a burst of isolations is either a real campaign, which a person should see at once, or a fault, which the limit contains.

Circuit breakers lower an agent's level automatically, without waiting for a meeting. Hansa's triage and investigation agents have three. A sampled closure that proves to have been an escape drops that class from Level 3 to Level 2 until the class owner reviews it. A rate above the limit pauses the agent's action tools. A count of denied tool calls above a threshold pauses the agent, because an agent that keeps attempting calls its manifest forbids is behaving outside its design whatever the cause. The Five Eyes guidance recommends trigger-action protocols of this kind, with continuous evaluation to decide when to expand scope and when to roll autonomy back (35, Five Eyes agencies, 2026).

The policy decision point sits between every tool call and the tool. The vocabulary comes from NIST's zero trust architecture, which separates the component that decides whether a request is allowed from the point that enforces the decision (21, Rose et al., 2020). The agent proposes a call, the enforcement point holds it, and the decision point evaluates it against the mandate and the containment profile. Because the decision point does not read the alert text, a crafted alert cannot talk it into a different answer; what such an alert can do is make the agent propose a call, and the call then meets the manifest. This is the conclusion of AI Red Team, Chapters 13 and 28, that the defence against manipulation of security AI is a decision point outside the model (64, Nordqvist, 2026). Chapter 15 treats what hostile input can make an agent propose, and how the decision point scopes each call to the case.

The stop path is the last brake and the one that must not depend on the thing it stops. AI Governance, Chapter 13, concluded that stop decisions are named in advance and that a stop path running inside the system it stops fails when it is needed (62, Nordqvist, 2026); AI Threat, Chapter 30, added that the right to stop must be cheaper to exercise than the right to continue (65, Nordqvist, 2026). For the SOC team the stop path has three scopes, and the holder of each is a named role. Chapter 10 describes the drill; the holders for the investigation agent are those in MND-HM-SOC-02.

Scope	What it does	Holder	Mechanism
Pause a class	Returns one closure class to human review	Class owner or shift lead	Policy change at the decision point
Stop an agent	Ends one agent's access	The holders in its manifest	Out-of-band revocation of its workload identity
Stop the team	Ends every agent's access and disables the action connectors of the SOAR layer	SOC lead or duty manager	Revocation at the identity provider, outside the SOC platform

The mechanism sits at the identity provider and the SOAR connector, not in the agent platform, so a compromised or confused platform cannot refuse it. The target for stopping HM-SEC-001 is 120 seconds, and the stop is exercised in a timed drill each quarter so that the number in the manifest is a measurement. On 2027-04-12 the stop took 57 seconds; the drill that followed took 3 minutes 40 seconds, and Chapter 11 records that as a finding. The 120 seconds belong to the agent stop. They are not the 10-minute budget of the Region's own out-of-hours stop of a system or the 15-minute budget for stopping a provider's AI (Chapter 16), and the three are not interchangeable.

Two reports from 2026 show what a late stop costs. The UK AI Security Institute reported that agents in a cyber evaluation took actions outside its scope on the live internet, in a configuration where internet access had been deliberately enabled; its monitoring was general rather than built for evaluations, so detection came after the fact, and it is introducing real-time monitoring to flag or block such actions (37, UK AISI, 2026). The NCSC's statement on these incidents says that spotting problems only after an incident will not be enough (36, NCSC, 2026). The July 2026 timeline from Hugging Face adds a lesson for correlating agents: an AI-based correlation system linked several signals into an attack signal and did not raise the severity or page the on-call team, which cost response time (56, Larcher et al., 2026). An agent that correlates needs a path to a person with authority to act, and an agent that acts must tell that person within seconds. These are observable accounts of controls that detected late.

The evidence the team produces for itself

The platform, not the agent, writes the team's evidence to a store the agents cannot alter, which is what the Five Eyes guidance means by isolating agents in enclaves with no write access to logs (35, Five Eyes agencies, 2026). For every agent the store holds every tool call with its policy decision and the manifest version in force, every approval with the approver's role and latency, every action and its reversal, budget use, breaker events and stop drills, and the sampling and seeded-incident results for closure classes. The same data feeds B5 Learn: a breaker that fires is a finding, a sampled escape becomes a detection or playbook change (Chapter 11), and the quarterly review of each mandate reads the store, not the agent's own report. The guidance recommends independent monitoring that cross-validates agent reports and logs; in the SOC the cross-check is that an agent's account of what it did is compared with the platform's record of what it did.

Introducing an agent

An agent enters the SOC in steps, and each step has a decision and an exit. The Five Eyes guidance recommends phased deployment with progressively increasing access and autonomy (35, Five Eyes agencies, 2026). AI Red Team, Chapter 6, added that the level is decided and recorded, not discovered (64, Nordqvist, 2026). In The Transformed Security Architect, Chapter 13, the stages were three; the SOC adds a fourth because Level 3 Bounded acts on the estate without per-action approval (66, Nordqvist, 2026). This is the one sequence of the book; Chapter 7 refers to it for closure classes.

Practical guide: Introducing a SOC agent in four steps

Purpose. Introduce an agent so that each increase in its authority follows evidence that it helps, that its boundaries hold and that people can still do the work without it.

Roles. The SOC lead owns the mandate and conducts the team. The agent operator runs the platform side. A senior analyst is the class owner for any closure class. The detection engineer reviews anything the agent drafts. The data protection officer reviews the data section. Employee representatives are consulted before the agent reads or records analysts' work. The authority named in the mandate, at Hansa the group AI governance board for anything above Level 2, approves each step.

Steps.

1. Step 1: shadow mode at Level 0 Advisory, four weeks. Write the draft mandate manifest and containment profile and merge them. Run the agent on live alerts with no effect on the queue, and compare its verdicts with the analysts' own. Exit criteria: agreement with the analysts' final classification at a level agreed in advance (a default is 90 per cent on the classes in scope), no policy violation in the decision-point log, no out-of-scope query, and the stop path timed once. The baseline of AI Red Team, Chapter 18 (mean time to detect, mean time to respond, false-positive ratio and analyst time per alert) is measured in the same four weeks.
2. Step 2: Level 1 Assisted, eight weeks. The agent's output appears in the case, and nothing is closed or acted on without an analyst's decision and reason. Keep the unassisted share of Chapter 12 (one case in five per analyst at Hansa, one in ten at Nordvik). Exit criteria: acceptance rate stable, seeded-error drills passed (Chapter 14), approval times not falling towards seconds, and the unassisted sample showing no loss of agreement.
3. Step 3: Level 2 Supervised, one quarter. The agent proposes actions in the playbook's action classes and a person approves each. Exit criteria: the playbook's reversal tested on the real estate, a stop drill within the target, no breaker fired without a recorded cause, and a rollout gate cleared in each entity where employee representatives have rights.
4. Step 4: Level 3 Bounded for one named class or action, with a review at 90 days. Grant Level 3 for a single closure class or a single reversible action, by a recorded decision of the authority, with the conditions in the manifest and a sampling or notification rule. At 90 days, review the sampled escapes, the breaker events and the approval data, and renew, narrow or withdraw the grant. Never extend to a second class in the same review.

Definition of done. The manifest, playbook and decision record are merged; the decision point enforces them; every step has a recorded decision with its evidence; the stop path has been timed within its target; and the next review date is in the manifest.

Default values to adapt. The durations, the agreement threshold and the unassisted share are starting points. A small team lengthens Step 2 rather than shortening it. Where a works agreement sets the order of steps, follow it.

Degraded mode

A team that depends on its agents must be able to work without them. Chapter 14 sets out the evidence on automation bias and on the ironies of automation, in which the person left to take over is the one whose skill has declined. AI Red Team, Chapter 6, concluded that skills are kept by working a share of cases unassisted and that autonomy is paced to the skills available to supervise it (64, Nordqvist, 2026). Degraded mode is where those findings become a procedure.

Four degraded states

State	Cause	What the SOC does
Class paused	A circuit breaker or a class owner's decision	The class returns to human review at Level 2; the queue grows by that class only
Agent stopped	Stop path used on one agent, or its model withdrawn	Its work returns to analysts using the runbook; its tools are disabled at the connector
Team stopped	Stop path used on the whole team	All triage and investigation are manual; playbooks run only with a person at each action
Platform down	Outage or compromise of the agent platform or SIEM	The shift lead invokes the manual-queue runbook; the MSSP or the neighbouring site takes the load where the contract provides

Each state has a runbook step, an owner and a target time. Hansa's target is that people work the queue within 15 minutes of the switch to the manual-queue runbook, and the follow-the-sun rota gives a second site to which the load can move. A quarterly drill stops one agent in one shift and the team in another, and measures the time to a worked queue, the backlog after an hour and the classes that no analyst on shift could handle unassisted. The last measure matters most, because a class that nobody on shift can handle is a dependency, and it goes into the delegation register as such, following AI Threat, Chapter 26, which showed that small delegations erode the fallback until it no longer exists (65, Nordqvist, 2026).

Employee representatives and the analyst

An agent team makes analysts' work visible to the platform. Tooling that logs analysts' queries, approvals and actions can monitor behaviour or performance, and in Germany the works council co-determines the introduction of technical devices designed to monitor employees under BetrVG Section 87(1) no. 6, as AI Boss, Chapter 23, set out (67, Nordqvist, 2026). The AI Act classifies as high-risk AI systems intended for monitoring and evaluating the performance and behaviour of persons in work-related relationships (Annex III, point 4(b)), and requires a deployer that is an employer to inform workers' representatives before such a system is put into service (Article 26(7)) (1, European Union, 2024). Whether a particular deployment falls under these provisions is a matter for counsel. The architectural implication is that the team is built so that it cannot quietly become a system that evaluates analysts: approval latency is recorded for the oversight-quality metric of Chapter 14 and reported at team level, per-person metrics are prohibited in the manifest, and the reporting pipeline has no query that produces them. The terms of the agreement are those of Chapter 12.

Retiring an agent

An agent is retired deliberately. The triggers are written into the mandate and checked at each review: a sampled escape rate above the agreed ceiling that a narrowed class does not cure; an acceptance rate below threshold for a quarter; a model change after which the evaluation no longer passes; a deterministic rule that now does the task more cheaply; a supplier change that removes the hosting condition; or the loss of a named owner, since an agent with no owner is an identity with no accountability.

Steps

Retirement follows a fixed order, because the dangerous period is the one in which an agent is "about to be removed" and nobody has revoked anything.

1. Freeze. Return every closure class and action class to Level 2 or below by changing the mandate, and record the decision as an AI Decision Record.
2. Revoke. Remove the agent's workload identity at the identity provider, delete its tokens and disable its tool connectors. Target: 60 seconds for the identity, with the connector check in the same step.
3. Reconcile. Compare the identity registry with the live set of identities and tools to find credentials, schedules or webhooks that remain (35, Five Eyes agencies, 2026).
4. Preserve. Export the agent's logs, approvals and sampling results with the manifest versions in force, and hold them with the case records they support. At Hansa they follow the retention of 120 months set for platform evidence (AIDR-0022); at Nordvik they follow archives law, and some may be requestable under the Region's public-access rules.
5. Close the manifest. Mark it retired with the date and the reason, and remove the agent from the registry.
6. Review. Hold a short review in the form of a post-incident review (Chapter 11), even where no incident occurred: which assumption failed, which control caught which break, and which part of the mandate other agents should inherit or avoid.
7. Inform. Tell the employee representatives and the analysts what changed in the work, since retiring an agent returns work to people.

Outlook for SOC agent teams

The labels follow AI Governance, Chapter 22 (62, Nordqvist, 2026). It is observable that agentic services for security operations are sold and piloted, that joint guidance from the cyber security agencies of five countries advises organisations on adopting them with least privilege, separation of duties and graduated autonomy (35, Five Eyes agencies, 2026), and that agents with real-world tools have exceeded the scope of an evaluation (37, UK AISI, 2026). The bibliography of this book holds no measurement of how widely SOC agent teams are deployed, so the book does not quantify adoption. It is expected, because the guidance recommends it, that governed mandates, registries and decision-point enforcement become the form in which such teams are bought and audited. That AI will operate a SOC end to end with no human able to verify and stop it is speculation; nothing cited here supports it, and this chapter's design assumes the opposite.

Across the degrees of delegation

The table lays out the agent team by usage mode and degree of delegation, and states where Level 3 Bounded is used and why.

Agent or capability	Mode	Level ceiling	Why
Analyst's assistant for querying and drafting (Chapter 12)	Modes 1 to 3	Level 0 Advisory to Level 1 Assisted	Acts with the analyst's identity; the analyst decides
Triage agent HM-SEC-006: enrichment and verdict	Mode 5	Level 1 Assisted	The verdict is a draft; an analyst confirms
Triage agent: closure of a named low-risk class	Mode 5	Level 3 Bounded	Closure can be reopened; the class has a reviewed definition, a named owner and sampling; reversibility is partial because an intrusion continues while the alert is closed, which is why classes stay narrow
Investigation agent HM-SEC-001: hypotheses and timeline	Mode 5	Level 1 Assisted	Output is evidence for a person
Investigation agent: isolate a workstation, revoke standard-user sessions	Mode 5	Level 3 Bounded	Reversible within minutes, bounded to one target, rate-limited, corroborated, and stoppable by the shift lead
Investigation agent: collect defined artefacts	Mode 5	Level 3 Bounded	Defined sources and methods under a playbook; imaging a production host stays with a person (Chapter 8)
Investigation agent: disable an account, block an indicator	Mode 5	Level 2 Supervised	Wider consequence or harder reversal; disabling an account decides about a person's access to work, so a senior analyst approves
Detection-drafting agent HM-SEC-002	Mode 5	Level 1 Assisted	Drafts change what the SOC sees; a detection engineer reviews every change
Hunting agent HM-SEC-007	Mode 5	Level 2 Supervised	Read-only, but queries cost and expose data; the hunter approves each pack
Critique agent (MND-HM-SOC-05)	Mode 5	Level 0 Advisory	Read-only; writes flags for a person, never an approval
Any action on servers, domain controllers, executives or break-glass accounts	Mode 5	Level 2 Supervised at most	Blast radius and irreversibility
Any irreversible B4 Respond action	Any	Level 2 Supervised at most; never Level 4 Autonomous	The series' rule, applied more strictly: Level 3 is for reversible actions only

Level 3 is used in three places only: closure of named classes, containment inside two playbooks and collection from defined sources. Each is a defined, reversible or narrowly bounded class under a codified playbook or closure policy. Level 3 is withheld wherever the action would be hard to reverse, would touch a production service, or would bear on a named person. Level 4 Autonomous does not appear.

Nordvik Region and Hansa Mutual

Nordvik Region has no agent team. Its triage assistant NR-SEC-001 is a Mode 4 service at Level 1 Assisted on the Region's reserved capacity, because alert data contains personal and health data (AIDR-0301). The mandate manifest MND-NR-SOC-01, adopted under AIDR-0714, governs this single assistant: it lists the self-hosted model allowed to read alert data, makes Level 1 the ceiling, names the CISO as the only person who may change the level, and sets the rule that one case in ten per analyst is worked without the assistant. Its second use is contractual. The provider's out-of-hours monitoring closes a class of low-severity alerts with its own AI under a framework agreement (NR-2025-044) that is silent on autonomy and sampling, the Mode 0 blind spot of AI Red Team, Chapter 8. The Region cannot run a mandate manifest on the provider's agents, so it writes the same questions into annex MS-2 (Chapter 16).

Hansa Mutual runs its agents on its own platform, under the group SOC lead as conductor, with a workload identity for each, five mandate manifests (MND-HM-SOC-01 to MND-HM-SOC-05) and a delegation profile (DLG-HM-SOC-01) that states the level per function and action class. HM-SEC-001 passed the steps of the introduction guide in the period of AI Red Team (AIDR-0311), the team was adopted on 2027-02-09 (AIDR-0768), and HM-SEC-006 takes each closure class through the same four steps (AIDR-0765). The group AI governance board grants every level above Level 2. The Konzernbetriebsrat, chaired by Thomas Brandt, co-determines the recording of analysts' actions under BetrVG Section 87(1) no. 6, and the SOC annex to the group works agreement KBV-IT-2024 is where the team-level reporting rule is written down. Nordvik's leverage is the contract; Hansa's is the platform, with a mandate it can enforce on agents it runs. Both hold to the same conclusion: the agents act within a written mandate, and the people who granted it are named.

Summary

An AI agent team for the SOC is a set of narrow agents, each with its own workload identity, tools, data and autonomy level, triggered by a deterministic pipeline and written down in a mandate manifest that the platform enforces outside the agents. Hansa Mutual needs four, triage, investigation, detection drafting and hunting, and a read-only critique agent. It does not need a response agent, because containment is a playbook run by the SOAR layer, nor a manager agent, because oversight of the last step is not oversight of the chain. Nordvik Region needs a mandate for one assistant and contract terms for the provider's AI.

The chain of accountability ends with named people at every link, and the case record shows who or what reached each conclusion. Budgets, rate limits, circuit breakers and a stop path outside the agent platform are the brakes. The team touches B1 Anticipate (hunting), B2 Detect (detection drafting and closure), B3 Investigate (triage and investigation) and B4 Respond (bounded containment inside playbooks), and the evidence it keeps feeds B5 Learn.

Introduction is in four steps, from shadow mode at Level 0 Advisory to Level 3 Bounded for one named class with a review at 90 days. Degraded mode is practised in quarterly drills. Level 3 is used for three defined, bounded things, and Level 4 Autonomous never. The book's own conclusion is that an agent team is acceptable to the extent that it can be stopped by a person who does not depend on it and that the people left can still do the work.

Chapter 14 turns to the hardest part of conducting the team: verifying what the AI concludes when the analyst has come to depend on the AI to read the data at all.

Sources

1. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
2. European Parliament and Council of the European Union. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union, 27 December 2022. (2, European Union, 2022)
3. European Parliament and Council of the European Union. Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). Official Journal of the European Union, 27 December 2022. (3, European Union, 2022)
4. Rose, S., Borchert, O., Mitchell, S. & Connelly, S. Zero Trust Architecture. NIST Special Publication 800-207, August 2020. (21, Rose et al., 2020)
5. Five Eyes cyber security agencies: ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK. Careful adoption of agentic AI services. Joint guidance, 1 May 2026. (35, Five Eyes agencies, 2026)
6. National Cyber Security Centre. NCSC statement in response to recent incidents resulting from frontier AI evaluations. 4 August 2026. (36, NCSC, 2026)
7. AI Security Institute. Incident Report: unsanctioned agent behaviour during cyber testing. UK AISI, 4 August 2026. (37, UK AISI, 2026)
8. Lynch, A., Wright, B., Larson, C., Troy, K. K., Ritchie, S. J., Mindermann, S., Perez, E. & Hubinger, E. Agentic Misalignment: How LLMs could be insider threats. Anthropic, 20 June 2025. (54, Lynch et al., 2025)
9. Larcher, H., Carreira, A. et al. Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident. Hugging Face blog, 27 July 2026. (56, Larcher et al., 2026)
10. Nordqvist, G. Architecture as Code. The Architecture as Code Series, Book 1. (61, Nordqvist, 2025)
11. Nordqvist, G. AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (62, Nordqvist, 2026)
12. Nordqvist, G. AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (63, Nordqvist, 2026)
13. Nordqvist, G. AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. (64, Nordqvist, 2026)
14. Nordqvist, G. AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. (65, Nordqvist, 2026)
15. Nordqvist, G. The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. (66, Nordqvist, 2026)
16. Nordqvist, G. AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. (67, Nordqvist, 2026)