Use case · Security · OI-200
SecOps automation, on a leash.
The hardest irony in security automation: the agents you build to contain incidents hold the most dangerous credentials in the building. They can revoke every session, rotate every key, and quarantine every host — at machine speed, with no human in the loop. Intended gates each of those actions with the same Authority Token surface it uses for engineering agents. Same audit chain, same fail-closed enforcement, the same 7-category Security Operations vocabulary.
01 · The most-privileged actor in the stack
A SOAR playbook is a standing root credential with a schedule.
An incident-response agent that can isolate a host can also isolate every host. A rotation bot that can replace one key can replace all of them and lock you out of your own environment. These are not hypotheticals — they are the normal failure mode of an over-eager agent reacting to a false positive. Permission does not distinguish the measured response from the catastrophic one; intention does. Intended scores each security action against the workflow it is supposed to live inside, and refuses the ones that fall out of pattern.
02 · The OI-200 surface
Every SecOps action resolves to one of 7 canonical intents.
The Security Operations domain (OI-200) is the shared language for what a security action intends — whether it comes from a SOAR runbook, a vulnerability scanner’s auto-remediation, or an analyst’s assistant.
Threat Detection
Incident Response
Vulnerability Management
Identity & Access
Credential Management
Security Policy
Data Protection
03 · What gets gated
Provisioning & revoke
Okta, Azure AD, and Vault actions are authority-bound through one plane. Bulk grants and privilege escalations raise the composite risk score before the IdP call lands.
Rotation, scoped
Rotators acquire a single-use token per rotation. Out-of-window or fleet-wide rotation escalates; the decision and its rationale are sealed into the audit chain.
Block · isolate · contain
Quarantine, session-kill, and firewall-rule actions taken by SOAR agents are token-gated. The justification — which detection fired, against which playbook — is preserved as evidence.
Snyk · ZAP · Veracode
Scanner-initiated auto-remediation and dependency bumps are gated through the same policy plane as human-initiated fixes. No silent auto-merge path.
04 · One enforcement model
The connector verifies, fail-closed, in the target system.
There is no separate enforcement model for security agents. The connector in front of your IdP, your secrets manager, or your EDR verifies the Authority Token — signature, TTL, intent hash, revocation — and refuses anything malformed, expired, or replayed right there at the boundary. The whole guarantee reduces to one line: no token, no action. Read the security posture for key isolation and audit-chain detail.