Not based on a specific customer deployment. The company, figures, decisions, and outcomes below are a constructed example that shows how Intended’s mechanism applies to this kind of problem. They are not measured results from a named customer. Where we publish a real, attributed customer outcome, we will say so explicitly.
Automating Incident Response with Governed AI Agents
Consider a cybersecurity firm running a 24/7 SOC for many enterprise clients. Its AI agents triage alerts from Splunk, isolate hosts in CrowdStrike, suspend compromised identities in Okta or Entra ID, rotate secrets in Vault, and page on-call engineers through PagerDuty.
01 · the challenge
The kind of problem this addresses.
02 · how it works
See the difference.
Threat detected
Lateral movement from compromised endpoint
Alert fires in SIEM
Priority: P1, but enters analyst queue
Analyst reviews (queue wait)
Queue backlog during off-hours
Manual containment
Analyst isolates the host by hand
Evidence collection
Manual, incomplete, no chain of custody
03 · the solution
What they deployed.
- — Policy rules for the SOC's detection, containment, and forensics actions
- — Pre-authorized P1 containment: host isolation, identity suspension, and secret rotation
- — P2/P3 containment escalates to an analyst in the Intended approval queue
- — The agents call Intended through the SDK or POST /v1/agent-intent before acting in CrowdStrike, Okta, Entra ID, Vault, PagerDuty, or the cloud consoles, and act with their own API credentials only after an ALLOW and a signed authority token
- — Intended decides and signs. It never holds the SOC's keys or calls its systems; services that accept containment requests can verify the token offline against Intended's published keys
- — Every decision lands in a tamper-evident, hash-chained audit trail, and signed authority.decision.created webhooks stream each one to the SIEM pipeline
04 · implementation
From zero to governed.
Week 1
Map
Catalogue the SOC agents' actions across detection, containment, and remediation, and decide which are pre-approved for P1.
Week 2
Configure
Write pre-authorization rules for P1 containment and approval routing for P2/P3. Check them with policy simulation.
Week 3
Integrate
Add the SDK call ahead of the agents' CrowdStrike, Okta, Entra ID, Vault, and PagerDuty actions. Point a webhook endpoint at the SIEM pipeline.
Week 4
Enforce
Enable enforcement. Pre-authorized P1 containment runs without waiting on a human, with its decision record attached.
05 · illustrative outcomes
What this is designed to deliver.
Modeled figures for this scenario — what the workflow above is built to achieve, not measured results from a named customer.
0%
P1 actions pre-authorized
No manual approval bottleneck
0%
Decisions in the audit chain
Hash-chained and tamper-evident
0
Severity tiers
P1 auto, P2/P3 analyst-approved
0 min
Max token lifetime
Each containment token is single-use
06 · decision replay
Example decisions, full trace.
Sample decision records that show the shape of the evidence Intended produces. Illustrative, not drawn from a live customer’s logs.
sec.incident.containmentRISK: 74/100ALLOWIsolate endpoint WS-ACME-4821 in CrowdStrike: lateral movement detected from compromised credentials
Resolved by: Policy: P1 containment pre-authorized (host isolation)
sec.incident.identity-suspendRISK: 68/100ALLOWSuspend Okta user jsmith@acme.com: compromised session detected
Resolved by: Policy: P1 identity suspension pre-authorized
sec.incident.containmentRISK: 82/100ESCALATEBlock outbound traffic from subnet 10.4.0.0/24: data exfiltration attempt
Resolved by: SOC Lead (approved subnet isolation)
sec.forensics.evidence-collectionRISK: 45/100ALLOWCollect memory dump from server DB-PROD-03 for forensic analysis
Resolved by: Policy: forensic collection auto-approved for active incident
sec.remediation.firewall-changeRISK: 88/100ESCALATEUpdate firewall rules to block known C2 IPs across all client environments
Resolved by: Security Director (approved global rule change)
the takeaway
Automated containment only works if it is accountable. Pre-authorizing P1 actions removes the approval wait from the most urgent incidents, while every action still carries a signed, policy-checked decision record that a client's security and legal teams can review afterwards.
Why this pattern matters — not a customer quote.
Start governing AI incident response
Free to start. See every AI decision from day one.