Research agents

Autonomous modules execute governed responses guided by reasoning layers while maintaining audit trails, false-positive controls, and escalation paths to human operators.

• Analysis planner: decides which analysis step to run next for a specimen.
• Reasoning agent: combines evidence into hypotheses about behaviour and intent.
• Mitigation agent: proposes containment, isolation, or traffic controls with expected impact and confidence.
• Learning loop: feeds reviewed outcomes back into training so future decisions improve.

• Observe: record and report only.
• Recommend: propose an action for a person to take.
• Act with approval: carry out an action once a reviewer approves it.
• Act within limits: carry out low-impact, reversible actions (such as extra analysis or sandbox containment) automatically.

High-impact actions (host isolation, network changes) always require approval.

The engine prototype runs a single analysis pass per specimen. Multi-step planning and a learned mitigation policy are phase 2 work, and the approval queue will be built into the research workspace alongside the platform API.