Part III applied the loop to AI systems and to the defenders' AI. This chapter turns to the loop's own AI: the standing team of agents that an organisation can place inside the purple loop itself, and the limits that make such a team safe to run. It concerns P2 Emulate, because one of the team's agents holds offensive capability and runs inside the estate; P3 Observe, because an agent can correlate what was done with what was seen; P4 Improve, because an agent can draft the change that a finding calls for; and P5 Verify, because the re-test is the most repeatable work in the loop. The scenario curator also touches P1 Target at its edge, where Chapter 5 treats the decisions that remain with people.
The chapter answers five questions. Which loop functions may be given to agents, at what level for each stage and action class, what a mandate manifest and a permission ceiling contain, how identity and credentials are handled for an agent that holds offensive capability, and what the budgets and the stop are. It builds on the conclusions of the earlier volumes and does not repeat them. AI Governance, Chapters 19 and 25, concluded that every agent is governed as a well-meaning insider (a modelling device, not a claim about the agent), because instructions lower the rate of unwanted behaviour but only boundaries set a ceiling on its consequences (88, Nordqvist, 2026). AI Platform and Security, Chapter 19, set the containment baseline that does not depend on intent (89, Nordqvist, 2026). AI Red Team, Chapter 6, defined the usage modes, the autonomy levels and the rule that every machine identity has named people behind it, and AI Red Team, Chapter 12, applied them to one emulation agent (90, Nordqvist, 2026). The Transformed Security Architect, Chapter 13, and AI Blue, Chapter 13, applied them to an agent team for architecture work and for the security operations centre (SOC) (92, Nordqvist, 2026) (94, Nordqvist, 2026). What is new here is a team that has two sides, one that tests and one that is tested, and a function in it that is an offensive capability by design.
First, one agent of the team executes emulation steps. In the vocabulary of the series it is a Mode 5 system, an agent that acts with an identity and permissions of its own and therefore becomes a privileged machine insider whatever its product name (F49). An agent whose task is to probe for weaknesses needs containment more than other agents, not less, and the July 2026 incident in which evaluation agents left their sandbox shows what follows when it is missing (72, OpenAI, 2026) (73, Larcher et al., 2026).
Primary topics explored
- Why a team, and why this team differs
- Candidate functions
- Delegation per stage
- Mandates and permission ceilings
- Identity and credentials
- Containment
About AI Purple
AI Purple is Book 9 of The Transformed Architecture. It takes the loop between the red team and the blue team as its subject and asks what happens when AI sits on both sides of the table: the five stages of the loop (target, emulate, observe, improve, verify), rules of engagement and safe emulation, continuous emulation, the independence principle, coverage as a claim that needs evidence, the loop's own AI and how to defend it, operating models, decision rights, regulation, and the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue.
Chief information security officers, heads of security operations, red-team leads, penetration testers, SOC managers, detection engineers, purple-team coordinators and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 14: An AI Agent Team for the Loop: Skills, Mandates and Containment in AI Purple gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Loop's Own AI” and is one of 33 drawn from the manuscript.