An AI Agent Team for the Loop: Skills, Mandates and Containment

All courses / AI Purple / Module 4 / Chapter 14

Learning objectives

After the lesson the participant can:

Classify the eight candidate functions by stage, side, what they read and what they write or do.
Explain the four questions that set a ceiling and why only the two runners reach Level 3 Bounded.
Draft a mandate manifest for an emulation runner that a policy decision point can enforce.
Compare the delegation profiles of Nordvik Region and Hansa Mutual and the reasons behind each.

Key concepts

Eight candidate functions: Scenario curator, emulation planner, emulation runner, observation correlator, detection drafter, finding triager, re-test runner and critic. They are functions and not products; several may run in one system as long as the separations hold.
Mandate manifest: The written mandate for one agent (MND), in version control: named owner, operators and authority, the rules-of-engagement reference, the catalogue binding, the level per action class, identity, budgets, circuit breakers, a never list, a separation list, review and expiry.
Critic: A function on a second model family at Level 0 Advisory that challenges the planner's choices, the correlator's outcomes and the drafter's detections. It reads outputs, never working stores, and it flags and questions but never gates.
Budgets and circuit breakers: Ceilings an agent cannot argue with: actions, targets, time and cost per run or period. Circuit breakers stop the run on conditions such as an action outside the permission ceiling, contact with an out-of-scope asset or real personal data in a result.
Pause, revoke, undo: The three forms of stop: the policy decision point stops admitting steps; the identity provider and egress gateway end the agent's credentials and routes from outside the runner; and the clean-up manifests are executed and confirmed.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Loop functions and what they write or do

Match each function of the loop's agent team with what the chapter's table says it writes or does.

Interactive exercise 2 · Scenario

A step that is not in the catalogue

Apply the chapter's rule that the runner executes a catalogue to a request at Hansa Mutual.

Teaching plan

15 min	The teacher explains why the loop's team differs from a SOC team: one agent executes emulation, the team sits on both sides, and three groups answer for it.
15 min	Participants place the eight functions on the five stages and assign a level to each using the four questions, then compare with Hansa Mutual's profile.
35 min	Exercise: write a mandate manifest for an emulation runner, including the never list, the separation list and the ceiling tests.
15 min	Pairs review each other's manifests: what can this agent reach whatever instructions it receives, and which dependencies does it share with another agent?
10 min	Plenary on what stays with people and on the practitioner's own use of AI in Modes 1 to 3, declared in the record.

Discussion

Nordvik Region delegates only the critic and the correlator and buys no runner. What would have to change, in capacity and in contract, before a Mode 5 runner made sense for it?
The triager ranks and routes but does not close. What damage could a triager do without ever exceeding that mandate, and how would you see it?
A team of eight functions invites one model gateway, one secret store and one log store. Which shared components in your own tooling would make two controls fail together?

Written exercise

Exercise · 35 minutes

A mandate manifest for an emulation runner

Following the ten steps of the practical guide, write a mandate manifest for an emulation runner in your own organisation or for Hansa Mutual's runner. Start from a signed rules-of-engagement manifest and make the mandate no wider. Name one owner, at least two operators, the authority that grants the level and the stop holders. Bind the catalogue, starting with S1 only, read-only to the agent. Set the level per action class. Give the agent a workload identity, test accounts only and short-lived tokens issued outside its runtime. Set budgets for actions, targets, runs and minutes. Write the circuit breakers, the never list and the separation list. Set review and expiry, and list the three planted conditions the policy decision point must refuse before the first run.

Deliverable: A mandate manifest of one to two pages with named people, ceilings, budgets, circuit breakers, never and separation lists, and three ceiling tests.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which functions reach Level 3 Bounded in Hansa Mutual's delegation profile, and for what?
Show the answer
C. The emulation runner and the re-test runner, for catalogued S1 scenarios inside the signed scope.
Only the two runners reach Level 3 in practice, and only for S1 scenarios inside a signed scope enforced by a policy decision point outside the agent. Everything else the agents produce is a draft at Level 1 or an objection at Level 0.
What does the chapter say the critic may do?
Show the answer
A. Flag and question the outputs of other functions, on a second model family, without gating.
The critic runs on a second model family at Level 0 Advisory. It reads the outputs of the other functions, never their working stores, and writes flags and questions; it never gates.
Which of the following is delegated to no agent at any level, according to the chapter?
Show the answer
D. Authorisation, the stop, the closure of a finding and the authorship of novelty.
Four things stay with people: a named authority signs the rules of engagement, named people hold the stop, a named person closes a finding, and human-authored novelty remains a human task. The other options are drafts or bounded tasks agents may perform.