The Transformed Blue Team Defined

The first three chapters of this book describe what the blue team does and what presses on it. This chapter defines what it becomes, and it does so in the form the series uses for anything that must hold whatever anyone intends: as an artefact. The transformed blue team is a team whose mandate, decision rights and degrees of delegation are written down, versioned and enforced, so that the question every security operations centre (SOC) now faces, which of the work a system may do and who answers for it, has an answer that can be read, tested and changed. The definition covers all five functions of Chapter 2, B1 Anticipate, B2 Detect, B3 Investigate, B4 Respond and B5 Learn, and it introduces the three artefacts that Parts II to V apply: the team charter, the delegation profile (DLG-*) and the delegation register. It answers which functions may be delegated to AI and to what degree, and adds who decides, how the decision is recorded and when it is reviewed.

The chapter builds on what the series has settled. AI Red Team, Chapter 6, set five autonomy levels per action, from Level 0 Advisory to Level 4 Autonomous, and drew the line that matters most between Level 2 Supervised, where a person approves each action, and Level 3 Bounded, where a system takes the action inside a codified playbook that a policy decision point outside the model enforces (64, Nordqvist, 2026). The same chapter distinguished the usage modes, from Mode 0 Ambient AI to Mode 5 Autonomous production agents, and concluded that the mode, not the model, sets the risk: in Modes 1 to 3 the AI borrows a person's identity, while a Mode 5 agent has an identity and permissions of its own. The Transformed Security Architect, Chapter 4, showed how to write a role down as a versioned artefact with a mandate, accountabilities and decision rights (66, Nordqvist, 2026). This chapter applies both to a team.

A role charter in The Transformed Security Architect states what a role is for, what it may decide, what it may only recommend and who may overrule it. It lives in version control, it has an owner and a review date, and it is the first place anyone looks when a decision is disputed. A team needs the same, for a reason that is easy to miss: a team that cannot state what it has delegated has delegated more than it knows. In both organisations of this book the delegations arrived one at a time. Hansa Mutual's investigation agent HM-SEC-001 was given Level 3 Bounded for two reversible actions by a single decision record (AIDR-0311). Nordvik Region's managed security service provider (MSSP) began closing low-severity alerts out of hours with its own AI under a framework agreement that says nothing about it, which is the Mode 0 blind spot of AI Red Team, Chapter 8 (64, Nordqvist, 2026). Each delegation was defensible or invisible. Nobody had written down the sum.

Primary topics explored

1. A team is an artefact
2. Mandate and decision rights
3. Degrees of delegation per function
4. Where Level 4 is never used
5. The delegation register
6. Accountability that does not move