A frontier-capable incident synthesizer that reads two upstream analyst feeds, decides severity, and escalates to opus only when the incident earns it — every call minted, policy-checked, and signed into an audit chain.
The SOC Lead ingests threat intelligence and analyst findings, then reaches for the most expensive frontier model on the roster the moment it smells a breach. Ungoverned, that is an unbounded blast radius: unbounded spend, unbounded data reach, and no defensible record of why any call was made.
Model picks its own tier. Reads any tenant's memory. No signed evidence of the decision. A prompt-injected "critical" burns frontier budget on demand.
Deny-by-default policy at the PEP. Per-agent capability token. RLS-isolated data tenant. Every hand-off and escalation written to an Ed25519 audit chain.
This is a live instance — 367 agents registered as control-plane tenants, each mapped to a real principal in the ACME directory and run under the same zero-trust policy the SOC Lead is bound by.
Two upstream agents feed it. It synthesizes, decides, and passes a hardened brief downstream. Nothing about that flow is implicit — each edge is a governed call through the enforcement plane.
The runner mints a per-agent HS256 capability token from its 64-hex secret. From there the request is validated, policy-evaluated deny-by-default, and forwarded verbatim to the agent's own data tenant.
On allow, the PEP signs the call into its audit chain and ships it to the control plane. Usage lands in tzt_usage and surfaces on the Grafana ROI board.
The SOC Lead does not gather its own intelligence. It reads what the threat-intel researcher and the security analyst already produced — both written to their own RLS-isolated tenants — and fuses them into a single severity call.
Upstream domain brief on emerging indicators, delivered as a governed CoT + memory write in its own soul-svc tenant.
Triaged findings from the analyst stage — the second and final upstream edge feeding the SOC Lead node.
Keyword escalation is the mechanism — when the synthesized incident carries +incident, +breach, or +critical, the agent lifts from its home tier toward its ceiling. The frontier model is reachable, but bounded by the ceiling policy.
The SOC Lead's judgment is not a chat message. It is a governed CoT and memory write into its own tenant, validated end to end, and it becomes the input to the next stage of the DAG.
The SOC Lead operates under continuous behavioral monitoring. If its trajectory drifts, SoulWatch quarantines it without waiting for a human — and an analyst can verify the whole audit chain after the fact.
SoulWatch scores behavioral drift and auto-quarantines the agent into a shared postgres store. RFC5424 syslog streams to Promtail:1514 → Loki as SIEM.
The PEP /admin/* console exposes audit/verify, soulwatch/status, quarantine, and analytics — trajectory, model_baseline, campaign, drift. Role-token gated at pdp.tiresias.watch.
Because escalation is bounded by policy, opus is reserved for the incidents that warrant it. The observed per-call economics show why that boundary matters — the frontier tier costs two orders of magnitude more than the floor.
| Model tier | Role for SOC Lead | Observed $/call | |
|---|---|---|---|
| opus-4.8 | Ceiling — high-severity only | $0.19 | |
| sonnet-4.5 | Routine synthesis | $0.03 | |
| deepseek-v4-pro | Cheap capable tier | $0.002 | |
| gpt-oss:120b | Self-host tier | $0.0015 | |
| gemma:free | Free floor | $0.00 |
Two upstreams synthesized, severity decided, opus reached only when it is earned — and every step minted, policy-checked, RLS-isolated, and signed. The capability is the easy part. The governance is what makes it deployable.