Chapter 12 described the analyst's own assistant, which acts with the analyst's identity. This chapter takes the next step: a standing team of narrow AI agents in the security operations centre (SOC), each with its own skills, identity, tools, data and autonomy level, and a human conductor who answers for the team. It concerns all five functions: B1 Anticipate through hunting, B2 Detect through detection drafting and alert closure, B3 Investigate through triage and investigation, B4 Respond through bounded containment inside playbooks, and B5 Learn through the evidence the team keeps about itself. It shows which agents a SOC needs, how mandates are written and enforced outside the agents, how accountability stays with named people, and how a team is introduced, run without and retired.
The chapter builds on the mandate and containment designs of AI Red Team, Chapter 18, and The Transformed Security Architect, Chapter 13, and adapts them to a team whose agents read the most hostile content in the organisation and hold some of its most powerful permissions (64, Nordqvist, 2026) (66, Nordqvist, 2026).
Hansa Mutual's SOC runs four standing agents (triage, investigation, detection drafting and hunting) and one read-only critique agent. It runs no response agent and no manager agent, and the rest of this section gives the reasons.
Primary topics explored
- Agents as a team
- Identity and permission
- Mandate manifests
- Orchestration and accountability
- Budgets and brakes
- Introducing an agent
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 13: An AI Agent Team for the SOC: Skills, Mandates and Containment in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Blue Team's AI Team” and is one of 32 drawn from the manuscript.