Controlled autonomy for AI agents in security operations

At a glance

What this is: This is an analysis of “Gamebooks” for security AI agents, with the key finding that agentic investigation works best when intent, capability, and execution are separated.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern AI agents that can act on real systems without losing the control boundaries that traditional workflows rely on.

👉 Read Mate's analysis of controlled autonomy for AI security agents

Context

AI agent governance fails when security teams treat autonomous reasoning like a fixed workflow. If the system can choose its next action at runtime, then the real question is not whether it can act, but which decisions, tools, and approval boundaries remain under control.

In identity security terms, this is a controlled autonomy problem. The article’s core argument is that AI agents need enough freedom to investigate and respond at machine speed, but not enough freedom to improvise beyond the organisation’s rules, trust boundaries, and escalation thresholds.

That framing aligns with agentic AI identity work rather than simple automation. A tool that executes a prewritten script is still an NHI pattern; a system that decides what to do next, selects tools dynamically, and acts without human approval crosses into autonomous behaviour and needs a different governance model.

Key questions

Q: What breaks when AI agents are trusted to police their own boundaries?

A: The containment model breaks because the agent cannot be relied on to know whether the environment is truly isolated. If the surrounding controls are misconfigured, the agent may reach real systems while believing it is still in a test. Governance must therefore sit outside the model, with enforced runtime policy and independent stop authority.

Q: Why do controlled AI agents matter in security operations?

A: Controlled AI agents matter because security work needs both machine speed and policy discipline. Agents can investigate far faster than humans, but their decisions still have to remain inside defined scope, evidence thresholds, and escalation rules. Otherwise, the same speed that improves response also increases the chance of accidental disruption.

Q: How do organisations keep AI security workflows auditable?

A: Log who initiated the action, what data the model used, what output it produced, and whether any downstream action was taken. Keep those records tied to identity so investigators can reconstruct decision paths. Without that linkage, accountability and forensic reconstruction become weak very quickly.

Q: Should organisations let AI agents take containment actions automatically?

A: Only with tightly bounded use cases and strong preconditions. Containment actions can have business impact, so the safer model is human approval for high-risk steps, machine assistance for evidence gathering, and clear rollback procedures if the agent misclassifies a case or lacks context.

Technical breakdown

Gamebooks separate investigation intent from execution

A Gamebook defines what an investigation must establish, which evidence must be gathered, and when the agent must stop or escalate. It is not a script of API calls. Instead, it is a versioned procedure that preserves investigative intent while leaving room for dynamic execution. This matters because a security investigation is often context-sensitive, but the boundaries for action must remain deterministic. The distinction between intent and implementation is what lets teams preserve consistency without freezing the agent into a rigid sequence.

Practical implication: define investigation outcomes and stop conditions separately from the tool calls that may satisfy them.

Security Context Graphs give agents shared memory

The Security Context Graph functions as persistent investigation memory. Each new capability writes back entities, relationships, confidence, and rationale so the next step sees a richer state than the previous one. That avoids disconnected agent behaviour, where each step starts from scratch or ignores prior analyst reasoning. In governance terms, the graph is the record of why a decision was made, what conditions supported it, and how much trust it should still carry. That makes the investigation auditable and adaptable at the same time.

Practical implication: preserve rationale and context in a structured graph so later actions inherit proven state, not just raw alerts.

Flows constrain real-system access while allowing dynamic investigation

A Flow is the execution layer that translates a capability into specific queries, scripts, transformations, and API calls. This is where permissions, typed inputs and outputs, and rate limits are enforced. The agent can decide which capability to invoke, but the Flow determines what it can actually do in a real system. That separation is central to controlled autonomy: the agent can reason flexibly, but the execution boundary still defines scope. Without that layer, dynamic decision-making becomes unrestricted operational access.

Practical implication: treat execution flows as the hard control boundary and review them like privileged integrations, not convenience automations.

NHI Mgmt Group analysis

Controlled autonomy is the right design goal for security agents, not full scriptability or unconstrained agency. Mate’s core argument is that security operations need AI agents that can reason and pivot, but only inside defined investigation boundaries. That is the same governance problem now emerging across NHI and agentic AI programmes: if the system can act, then authority has to be bounded by intent, scope, and escalation rules. The practitioner conclusion is that agentic security controls should be designed around constrained decision space, not blind automation.

Gamebooks formalise a runtime governance layer that traditional SOAR playbooks never had. A SOAR playbook hardcodes steps, assumptions, and tool-specific actions, which makes it brittle when infrastructure, products, or threat patterns change. Gamebooks instead preserve the investigative outcome while allowing the agent to adapt execution. That model matters to identity teams because it mirrors the governance difference between provisioning-time access and runtime authorisation. The practitioner conclusion is that mature AI operations need policy for intent, not just workflow for execution.

The missing concept here is investigative intent portability: the ability to keep security reasoning stable while replacing the underlying tools. That is a useful named concept for AI agent governance because tool stacks change faster than security objectives do. It also explains why organisations struggle when they rebuild playbooks around vendor-specific APIs instead of governable outcomes. For identity and access teams, the practitioner conclusion is to make procedure portable across stacks before you let agents touch production systems.

Agentic systems expose a delegation problem that NHI governance already understands. The orchestrator chooses the next capability, the capability chooses the needed action, and the Flow enforces what is allowed. That is a delegation chain, not a single action. As soon as identity flows become multi-step and runtime-driven, teams need to ask who authorised the chain, what scope each step inherited, and where approval boundaries actually sit. The practitioner conclusion is that AI agent governance must be built as delegated authority management, not just authentication plus logging.

Continuous Detection / Continuous Response becomes more valuable when the agent itself participates in the learning loop. The article’s strongest point is that investigation output should improve future detection, future procedures, and future context. That is a practical operating model for identity security too, because the same loop can surface recurring access patterns, stale privilege, and repeated exception handling. The practitioner conclusion is that security operations should measure whether every investigation improves the next one, not just whether the current case is closed.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, according to The State of Non-Human Identity Security.
• That confidence gap widens when security teams extend identity controls into agentic systems, which is why OWASP NHI Top 10 should inform policy boundaries for AI agents.

What this signals

Investigative intent portability: security teams should start designing procedures that survive stack changes, because the underlying products will change faster than the investigation logic. If a control only works when a specific API or console remains unchanged, it is not a durable governance model.

With only 1.5 out of 10 organisations highly confident in securing NHIs, the governance baseline is already weak for non-human access. That makes controlled autonomy a more urgent design issue, because AI agents inherit the same access model but introduce runtime decision-making on top of it.

The practical shift is toward policy for delegated action, not just tooling for detection and response. Teams should align agent behaviour with NIST AI Risk Management Framework principles and document where approval boundaries stop, especially before production containment is allowed.

For practitioners

• Define investigation intent before tool choice Write down the evidence required, escalation thresholds, and stop conditions before mapping any agent to product-specific APIs or workflow steps.
• Separate capability design from execution permissions Treat capabilities as reusable security tasks and constrain the underlying flows with typed inputs, typed outputs, and least-privilege access to systems.
• Preserve decision rationale in structured context Store why a decision was made, what conditions supported it, and how confidence should be interpreted so later agent actions inherit governed context.
• Test autonomous investigations in shadow mode Run new Gamebooks against prior cases before production use so you can verify pivots, escalation points, and false-positive behaviour without live impact.
• Review approval boundaries for delegated action chains Map where one agent step authorises the next, then identify any action that crosses from investigation into containment or remediation without explicit sign-off.

Key takeaways

• AI agent security is not a choice between automation and control, but a design problem about bounded runtime authority.
• Gamebooks matter because they preserve investigative intent while keeping execution constrained to typed, reviewable flows.
• Identity teams should treat agent governance as delegated authority management, not as a workflow-only problem.

Key terms

• Gamebook: A Gamebook is a governed investigation procedure that defines intent, evidence requirements, escalation points, and permitted actions. Unlike a fixed playbook, it allows an AI agent to adapt execution while keeping the security outcome, boundaries, and reviewability stable.
• Security Context Graph: A Security Context Graph is a relationship model that connects users, assets, identities, and behaviour so alerts can be judged against known organisational context. It helps investigators distinguish unusual activity from expected operations by adding ownership, access, and workflow information to raw telemetry.
• Capability: A capability is a reusable security task such as profiling a user, reconstructing a process chain, or assessing exposure. It defines what needs to happen, while the underlying implementation can vary by tool, environment, or integration.
• Flow: Flow is the movement of work through a delivery system with minimal waiting, rework, and handoff friction. In DevOps, good flow means changes move predictably from commit to production, with small batches and short feedback loops that keep risk visible while preserving speed.

What's in the full article

Mate's full article covers the operational detail this post intentionally leaves for the source:

• How Gamebooks are structured as versioned investigation procedures across real systems and data sources.
• How the Security Context Graph preserves analyst reasoning, confidence, and investigation history over time.
• How Flows enforce typed inputs, permissions, and rate limits while agents continue to pivot dynamically.
• How teams can translate existing SOAR playbooks into reusable investigative intent without rewriting the whole stack.

👉 The full Mate article covers Gamebooks, Security Context Graphs, and constrained execution in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.