367 AI agents are doing real work inside ACME today. The question for the SOC is not whether to allow them — it is whether you can see them, signal on them, and quarantine them the way you already do endpoints.
Autonomous agents behave like a new workforce with no badge, no shift, and no SOC surface. Three failure modes matter to your desk.
Not a lab. A live Tiresias-ZT + Asphodel deployment on GCP where every agent is a registered tenant with an identity, a policy, and an audit trail.
The 360 fleet agents are mapped like-for-like to the real ACME org — department by role-family, by headcount, across all 28 departments, 10 regions and 626 roles. Every one is enrolled to a single enforcement point at site acme-site
Every governed call an agent makes crosses the Policy Enforcement Point (PEP) on :8343 before it reaches any data. There is no side door.
X-Tiresias-Api-Key tenant key
X-Capability-Token HS256, minted per-agent from a 64-hex capability secret
Policy evaluates deny-by-default. On allow, the request forwards verbatim. On deny, it never touches the backend.
Signed audit chain — SoulKey Ed25519 — ships to the control plane, with a durable write-ahead log at /data/audit-wal.
Tamper-evident by construction: the chain signs each governed call as it happens.
The SOC-facing surface is running now — real ports, real stores, real signal — on the acme-demo host.
The same primitive you use for user-behavior analytics, applied to agents. SoulWatch watches each agent's behavioral baseline and acts without waiting for a human.
Agent governance events are not a proprietary black box. They emit standard RFC5424 syslog — the format your SIEM already parses.
RFC5424 over TCP to Promtail on :1514. Point your own collector at the same stream, or take the Loki store as-is.
Loki holds the governed event log; Grafana renders it. The usage postgres datasource (acme-tzt-usage → tzt_usage) carries tenant, agent, model, tokens and cost per bucket.
The showcase agents run a 14-edge topological hand-off DAG — a work chain that starts at threat intel and ends at compliance. Every edge crosses the PEP, so the whole chain is auditable end to end.
When work is tagged as a real event, the governed runner does not degrade quietly — it escalates the model tier so the hardest analysis gets the strongest model, under policy.
Detection and containment are only useful if a human can review, verify, and clear. The PEP /admin surface is role-token gated and purpose-built for that.
License state, and audit/verify against the Ed25519 chain — confirm the log has not been tampered with.
Analytics by trajectory, model_baseline, campaign, and drift — the evidence behind a quarantine decision.
The same usage stream that feeds the SOC feeds the ROI board. When an incident escalates to frontier, you see exactly what that decision cost — observed $/call, per model.
| Model | Tier | Observed $/call | Relative |
|---|---|---|---|
| opus-4.8 | frontier (escalation target) | $0.19 | |
| sonnet-4.5 | paid mid | $0.03 | |
| deepseek-v4-pro | Ollama Cloud | $0.002 | |
| gpt-oss:120b | Ollama Cloud | $0.0015 | |
| Llama-70B (HF) | HuggingFace | $0.0012 | |
| gemma:free | free-homed floor | $0.00 |
You already have the muscles — SIEM, UEBA, quarantine, incident hand-off. Tiresias-ZT points them at the 367 agents that are already inside ACME.