A zero-trust SOC agent that triages and analyzes under a capability token, a deny-by-default policy, and a signed audit chain — one governed job at a time.
Security triage is the one seat where an autonomous agent touches the highest-signal, most sensitive data. If it reasons off-policy, escalates silently, or writes where it shouldn't, the blast radius is the org itself — 325,154 principals across 28 departments.
The security analyst is a first-class tenant in a live fleet — every agent enrolled, policy-scoped, and metered. No agent is an exception to the plane it runs in.
The showcase agents form a topological hand-off graph. The security analyst is the second node — it receives from threat-intel, then hands off up the chain to the SOC lead. Position is policy: it can only accept and emit where the DAG allows.
The analyst never talks to data directly. Every governed call carries a tenant API key and an HS256 capability token the agent mints from its own 64-hex secret. The PEP validates both, evaluates policy, and denies unless explicitly allowed.
X-Tiresias-Api-Key tenant identity
X-Capability-Token HS256, self-minted from 64-hex secret
Validate key + token → evaluate policy → deny-by-default. On allow, forward the request verbatim to this tenant's soul-svc backend — nothing added, nothing rewritten.
This is not a mock. Every governed call is validated at the enforcement plane, signed into an Ed25519 audit chain, and metered into the usage store behind the ROI board.
The analyst picks up an alert, reasons over it, and writes its conclusion to memory. Every hop is governed — the LLM answer becomes a governed chain-of-thought and a memory write into the ACME data tier.
The analyst's reasoning is captured, not discarded. Two governed endpoints land the work in a tenant-isolated database where row-level security is forced — the agent can only ever see and write its own rows.
The analyst homes on a free model and stays there for routine triage. Incident keywords escalate it to a standard paid tier; on any LLM failure it degrades to a free floor rather than going dark. Spend follows severity, never habit.
| Tier role | Model | $/1M-token economics | |
|---|---|---|---|
| Home (routine triage) | hermes-405b:free | $0 | |
| Escalation (incident/breach/critical) | sonnet-4.5 · standard | $0.03 / call | |
| Ceiling (deepest analysis) | opus-4.8 | $0.19 / call | |
| Floor (fast free degrade) | llama-3.2-3b:free | $0 |
Free tiers saturate — hermes-405b:free returns chronic 429s under load. The analyst's floor is a free model chosen for reliable degrade, so a rate-limited home never becomes a stalled agent. That saturation is exactly the self-host case the ROI board makes.
Governance does not end at the write. The analyst's calls are signed, its memory and reasoning are inspectable in the console, and drift trips an automatic quarantine — oversight is continuous, not periodic.
acme-asphodel-ui (:3001) · console.asphodel.ai — agents, memory / CoT review, mindsets, access & route policy, backend reachable.
PEP /admin/* · pdp.tiresias.watch — audit/verify, soulwatch/status, quarantine, analytics: trajectory · model_baseline · drift.
Deny-by-default at the door. A capability token on every call. Reasoning captured, memory RLS-isolated, spend matched to severity, and a signed chain behind all of it. One of 367 — governed the same way, provable the same way.