Agents make security operations faster. The design problem is letting them work at that speed without handing them the keys.
A reference design for an enterprise security estate, set beside the version I run every day. Same pattern, two scales.
Companion page: the two-handed estate, how work is split across model families before it reaches these gates.
flowchart TB
ref_SVC["<b>Security services</b><br/>detection · keys and certificates ·<br/>secrets · crypto inventory · AI model testing"]
ref_FLEET["<b>Agent fleet</b><br/>watches, analyzes, proposes;<br/>holds no write credentials"]
ref_G1["<b>Guardrails</b><br/>deterministic checks on every change<br/>to the agents' own code and prompts"]
ref_G2["<b>Independent review</b><br/>parallel reviewers, an adversarial<br/>verifier, one verdict"]
ref_G3{{"<b>Signed approval</b><br/>a person signs the exact change;<br/>what is signed is what runs"}}
ref_G4["<b>Access tiers</b><br/>read · propose-only · narrow lanes<br/>of earned autonomy, revocable"]
ref_PROD[("Production estate")]
ref_EV["<b>Evidence and reporting</b><br/>every action logged; risk, value<br/>and status for leadership"]
ref_SVC ==> ref_FLEET
ref_G1 -. "checks" .-> ref_FLEET
ref_FLEET -- "changes to itself" --> ref_G2
ref_FLEET -- "changes to production" --> ref_G3
ref_G3 --> ref_G4 --> ref_PROD
ref_FLEET -. "publishes" .-> ref_EV
class ref_SVC,ref_FLEET,ref_EV core
class ref_G1 rail
class ref_G2,ref_G4 check
class ref_G3 gate
class ref_PROD store
classDef core fill:#EAF2FB,stroke:#1667b8,stroke-width:1.5px,color:#16324f
classDef rail fill:#FFFFFF,stroke:#1667b8,stroke-width:1.2px,stroke-dasharray:5 4,color:#16324f
classDef gate fill:#0e7a4e,stroke:#0e7a4e,stroke-width:1.5px,color:#FFFFFF
classDef check fill:#F2FAF6,stroke:#0e7a4e,stroke-width:1.5px,color:#16324f
classDef store fill:#FFFFFF,stroke:#5b7288,stroke-width:1.2px,color:#16324fAgents watch and propose. A person signs the exact change before anything reaches production, and autonomy is earned one narrow lane at a time.
flowchart TB
home_WORK["<b>Workloads</b><br/>research sweep · AI game server ·<br/>homelab ops and backups · assistant routines"]
home_FLEET["<b>Claude Code + a 15-agent team</b><br/>reads, drafts, proposes;<br/>sends nothing on its own"]
home_G1["<b>Session hooks</b><br/>owned by root, so the agent<br/>cannot edit its own rails"]
home_G2["<b>Review squad</b><br/>parallel auditors, an adversarial<br/>verifier, one ship verdict"]
home_G3{{"<b>Human release</b><br/>list what leaves, scan for secrets;<br/>the release is logged"}}
home_G4["<b>Narrow write lanes</b><br/>dashboard buttons write one word;<br/>sends and posts stay human"]
home_OUT[("Git remotes · web · inboxes")]
home_EV["<b>Dashboard and graded claims</b><br/>what waits on whom; every state claim<br/>measured, observed, reported or inferred"]
home_WORK ==> home_FLEET
home_G1 -. "brackets every session" .-> home_FLEET
home_FLEET -- "changes to itself" --> home_G2
home_FLEET -- "anything outbound" --> home_G3
home_G3 -- "released exactly as reviewed" --> home_OUT
home_G4 -. "limits what the dashboard can change" .-> home_FLEET
home_FLEET -. "publishes" .-> home_EV
class home_WORK,home_FLEET,home_EV core
class home_G1 rail
class home_G2,home_G4 check
class home_G3 gate
class home_OUT store
classDef core fill:#EAF2FB,stroke:#1667b8,stroke-width:1.5px,color:#16324f
classDef rail fill:#FFFFFF,stroke:#1667b8,stroke-width:1.2px,stroke-dasharray:5 4,color:#16324f
classDef gate fill:#0e7a4e,stroke:#0e7a4e,stroke-width:1.5px,color:#FFFFFF
classDef check fill:#F2FAF6,stroke:#0e7a4e,stroke-width:1.5px,color:#16324f
classDef store fill:#FFFFFF,stroke:#5b7288,stroke-width:1.2px,color:#16324fThe same pattern on my own hardware: a homelab, a fifteen-agent team, and nothing that leaves without a release.
The grade says how each claim about the running estate is known.