Three agents — threat-intel-researcher, security-analyst, soc-lead — running the incident hand-off DAG under deny-by-default policy, a signed audit chain, and behavioral-drift quarantine. Real work, on a live zero-trust stack.
Security Operations is the one department that cannot accept an AI worker on trust. Every read of intel, every hand-off, every escalation has to be authorized, isolated, and provable after the fact — or the tooling becomes the attack surface.
Shared credentials, silent tier-hopping, no per-call attribution, no way to prove an agent stayed inside its mandate when an auditor asks six weeks later.
Deny-by-default policy at the PEP, per-agent capability tokens, an Ed25519-signed audit chain, and SoulWatch drift detection that quarantines a misbehaving agent automatically.
Security Operations is not a bolt-on. It is one segment of a fleet that mirrors the Acme directory like-for-like — every department, region, and role-family represented.
Nothing an agent does touches data directly. The Enforcement Plane (PEP) validates, evaluates policy deny-by-default, and only then forwards verbatim to the agent's isolated backend.
Security Operations owns the front of a 14-edge topological hand-off DAG. Intel is gathered, triaged, and escalated across three named agents before the work leaves the department.
Gathers and normalizes raw intel into a domain brief. Entry point of the DAG; feeds the analyst.
Analyst triages and correlates; soc-lead adjudicates severity and decides whether to escalate up-tier or hand off out of the department.
These are not projections. They are read off the live GCP deployment — the same figures the ROI board and CP registry serve today.
Each agent runs a home tier with a ceiling and a floor. Keyword escalation moves a job up only when the incident warrants it — and cost follows severity, not habit.
Behavioral drift is not a report you read on Monday. SoulWatch watches every governed call, and an agent that strays from its behavioral baseline is auto-quarantined — no human in the loop required to stop it.
SoulWatch scores behavioral drift against baseline across the agent's governed trajectory, model_baseline, campaign, and drift analytics.
On drift, the agent is written to the shared postgres quarantine store and blocked at the PEP — durable across restart, reviewable from the analyst console at pdp.tiresias.watch /admin.
Every enforcement event is RFC5424 syslog. It flows straight into the observability stack SecOps already understands — structured, queryable, correlatable with the rest of the estate.
The question an auditor asks is not "do you trust the agent" — it is "prove what it did." The signed audit chain and the analyst console answer that without reconstruction.
Each governed call is signed into an Ed25519 audit chain with a durable WAL, shipped to the control plane. Tampering breaks the chain; nothing is retro-editable.
Analyst review at PEP /admin (pdp.tiresias.watch): license, audit/verify, soulwatch/status, quarantine, analytics. Management at asphodel-ui :3001 (console.asphodel.ai).
The ROI dashboard reads tzt_usage directly. SecOps reserves the top tier for genuine incidents and lets everything else run cheap — the spread is three orders of magnitude.
| Model / tier | Provider | Relative cost | $ / call |
|---|---|---|---|
| opus-4.8 · ceiling | OpenRouter paid | $0.19 | |
| sonnet-4.5 | OpenRouter paid | $0.03 | |
| deepseek-v4-pro | Ollama Cloud | $0.002 | |
| gpt-oss:120b | Ollama Cloud | $0.0015 | |
| Llama-3.3-70B | HuggingFace | $0.0012 | |
| gemma-4-31b:free | OpenRouter free | $0.00 |
Three named agents on the incident hand-off DAG, every call deny-by-default at the PEP, every action signed into an Ed25519 chain, drift auto-quarantined, and the whole trail in your SIEM. Live today on the ACME instance.