An AI Agent Team for Security Architecture: Skills, Mandates and Containment

All courses / The Transformed Security Architect / Module 3 / Chapter 13

Learning objectives

After the lesson the participant can:

• Describe the five agent roles of a security architecture team with what each writes, its mode, identity and default level.
• Write a mandate manifest with a level per action, a list of what no agent may ever do, budgets, escalation rules and a stop path.
• Explain the seven containment measures for the architect's own agents and why control artefacts stay out of their reach.
• Assess whether an organisation has the capacity to supervise an agent team, using the staged introduction and Nordvik's decision to defer.

Key concepts

Narrow agents

Agents triggered by events in the architecture repository, each needing only what its task requires. One general assistant would need the union of all permissions; narrow agents can be bounded and stopped one at a time.

Mandate manifest

The written mandate of the architect's agents, kept as code and not a prompt. The identity provider, the policy decision point, the egress gateway and the branch rules read it, and where it disagrees with the containment profile the narrower one wins.

Agents draft; humans approve

A property of the repository, not a habit: branch protection requires review by code owners, the code-owner file lists only named architects, and the merge is always performed by a person. No agent approves its own output or another agent's.

Disagreement without arbitration

When the pipeline detects conflicting agent outputs on a pull request, it labels it, places both outputs side by side and requests review from the code owner of the affected path, who decides and records the rationale. No agent arbitrates and there is no vote.

Agents that read people's work

A review agent sees who wrote what, so agent output attaches to the change, not the person; the manifest prohibits per-person metrics and performance evaluation, and review-quality measures are reported at team level as agreed with employee representatives.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter warns that a falling rejection rate may mean reviewers have stopped looking. What evidence would you require before granting an agent a higher autonomy level?
2. Nordvik's reasons for deferring an agent team concern capacity, not technology. Which of its review triggers would have to be met in your organisation before a team makes sense?
3. A review agent on an architecture repository holds all three legs of the lethal trifecta by default. How would you break the trifecta for each agent in a team you might run?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which is the only action that runs at Level 3 Bounded in Hansa Mutual's architecture agent team?

   1. The policy author pushing a tested egress rule to the main branch
   2. The evidence collector refreshing an evidence link within an approved playbook
   3. The reviewer approving documentation changes with no control effect
   4. The threat modeller accepting low-risk candidate threats
   Show the answer

   B. The evidence collector refreshing an evidence link within an approved playbook
   Only maintenance of the evidence record, which describes the architecture and does not change it, may run at Level 3 Bounded: the evidence collector's refresh of an evidence link, which keeps the previous link and changes no control.

2. How is the work of the agent team orchestrated, according to the chapter?

   1. By a manager agent that assigns tasks to the narrow agents and filters their outputs for the architect
   2. By the reviewer agent, which decides which drafts reach a person
   3. By a vote among the agents when their outputs conflict
   4. By a deterministic pipeline; no agent assigns work or decides which outputs reach the architect
   Show the answer

   D. By a deterministic pipeline; no agent assigns work or decides which outputs reach the architect
   The orchestration is a deterministic pipeline, not a manager agent. No agent assigns work to another or decides which outputs reach the architect, and conflicts are placed side by side for the code owner.

3. Why did Nordvik Region reject option A, building a five-agent team, in AIDR-0503?

   1. One architect cannot supervise a team and there is no second reviewer
   2. Hosting outside the reserved capacity is not accepted
   3. The union refused consultation under the co-determination agreement
   4. Open-weight models were found too weak for threat modelling
   Show the answer

   A. One architect cannot supervise a team and there is no second reviewer
   Option A was rejected because one architect cannot supervise a team and there is no second reviewer. Option B, a supplier's service, was rejected over hosting; option C extended MND-NR-01 with a research skill at Level 0 Advisory.