Skip to content

Use Cases / Security

Security at Speed

Incident response agents act at machine speed within bounded authority. Destructive actions escalate. Every decision is cryptographically signed and hash-chained for forensic review.

Request DemoSecurity Overview

Response Risk

Uncontrolled blast radius

Automated remediation can cause more damage than the incident when scope is unconstrained.

No audit trail under pressure

Manual incident response bypasses change management. Forensic review happens weeks later, if at all.

Binary automation

Existing tools offer all-or-nothing automation. Intended provides graduated authority with risk-proportional controls.

Control Pattern

Bounded incident response

Generally Available

Host isolation, session revocation, and network quarantine actions execute under policy-defined authority limits. Agents respond at machine speed within explicit boundaries.

Escalation for destructive actions

Generally Available

Credential rotations, firewall rule changes, and organization-wide revocations route to human approvers with full evidence payloads. No destructive action executes without explicit approval.

Risk scoring with security context

Generally Available

Eight-factor risk model evaluates blast radius, reversibility, environment sensitivity, and privilege level. Security teams configure thresholds per action class.

Forensic audit chain

Generally Available

Every containment action produces a hash-chained audit record with HMAC-signed evidence bundles. Compliance teams verify decisions independently without database access.

Connector SDK for SOAR integration

Generally Available

Build custom execution adapters for your SOAR platform, EDR tooling, or cloud security services. The SDK enforces token verification before any adapter executes.

Identity-aware authority rules

Readiness Mode

Policy rules bind to actor identity, role, and trust score. New agents start with constrained authority that expands as operational reliability is demonstrated.

json
{
  "action": "iam.revoke_session",
  "target": "compromised-service-account",
  "environment": "production",
  "context": {
    "severity": "critical",
    "blast_radius": "single_identity",
    "reversibility": "reversible"
  }
}

→ Decision: AUTHORIZED
→ Risk Score: 38
→ Rationale: Single-identity revocation within
   reversibility boundary. Auto-approved per
   policy sec-incident-response-v3.
Security intent evaluated and authorized in < 50ms.

Scenario Outcomes

Host isolation

Authorized

risk: 28/100

Single-host, reversible containment within policy bounds.

Org-wide credential rotation

Escalated

risk: 72/100

High blast radius triggers human approval requirement.

Firewall rule deletion

Denied

risk: 94/100

Irreversible, org-wide impact exceeds deny threshold.

Protect every action.