Give an AI SOC agent the least autonomy that still saves real time. Start with read-only analysis, add reversible low-impact actions after measuring, and keep high-impact actions such as isolating hosts or disabling accounts behind human approval. Autonomy is something an agent earns with evidence.
Why autonomy is the real question
Whether a model writes good summaries matters less than what happens when it is wrong. OWASP names excessive autonomy as one root cause of its excessive agency risk: the application does not independently verify or approve high-impact actions. The same page ties the problem to hallucinated or manipulated model output, so an agent can act on a mistake or on an attacker's planted text.
Four levels
Level 1: Read and summarize. The agent reads alerts and writes notes. Nothing changes in any system. Risk is a wrong or misleading summary.
Level 2: Recommend. The agent proposes a priority and next steps. An analyst chooses. Risk is automation bias, where people accept suggestions without checking.
Level 3: Act with approval. The agent prepares an action, such as a containment step, and a person approves it with one click. The evidence is shown next to the proposal.
Level 4: Act alone. The agent runs the action without a human. Reserve this for narrow, reversible cases you have measured.
A decision guide
Ask four questions about each action before choosing a level.
- Can it be undone quickly? Adding a tag can. Deleting a mailbox cannot.
- How much damage can a wrong call do? Blocking a hash is smaller than disabling an executive account.
- How reliable is the model on this exact alert type? Measure on your own closed tickets. See metrics for AI alert triage.
- Could attacker text steer the decision? If the agent reads attacker controlled fields, assume it can be steered. Read prompt injection in SOC AI assistants.
If the answer to the first is no, or the second is high, require approval.
Controls that go with any level
OWASP lists mitigations that fit here: offer the model only the tools it needs, prefer granular tools over open-ended ones like a shell, grant minimum permissions, run actions in the user's context where possible, and enforce authorization in downstream systems instead of trusting the model. It also says logging and rate limiting limit damage but do not prevent the problem.
Add a kill switch. Someone should be able to turn the agent off in one step and know what it did in the last hour.
Moving up a level
Promote an action only after a trial where the agent proposed it, humans decided, and you compared the two for a meaningful sample. Write down the evidence and the date. Demote it if error patterns change, for instance after a log format update.
Quick check
Is human approval just a bottleneck?
For high-impact actions it is the control. You can reduce the burden by showing evidence beside each proposal and batching low-risk approvals.
What is the safest first project?
Read-only summaries of alerts your analysts already handle, with the raw evidence shown alongside.
Sources
Last reviewed: 19 October 2026.
