Function cockpit
Information Technology
Agents resolve, provision and remediate. Humans hold cyber and change authority.
Phase: Phase 4 — Governed autonomy
Run service, identity and infrastructure as a self-healing estate: classification, routine resolution, approved provisioning, telemetry correlation and patch staging are agent work; privileged access, architecture and major incident command remain human.
Trust score
0
Touchless
0%
Human review
0%
Override rate
0%
Capacity released
30-50% reduction in routine service effort, with sustained human investment in architecture and cyber
Accountable human
Chief Information Officer
CoS agent: IT Chief of Staff
Gates, kill switches, and the decision ledger
Governance
Autonomy is only defensible if the brakes are documented
Every gate below names a threshold, an approver, and a clock. Everything the function has decided recently sits in the ledger underneath, whether a person or an agent made the call.
Active gates
0
Pending decisions
0
Approved this cycle
0
Contained or reversed
0
Gate register
The conditions under which an agent must stop and ask.
| Gate | Trigger threshold | Approver | SLA | Waivable |
|---|---|---|---|---|
Privileged access grant Approval gate | Any administrative, root or elevated entitlement | Identity governance and system owner | 4 business hours | Hard stop |
Firewall or network boundary change Approval gate | Any rule affecting segmentation, ingress or egress | Network security lead | 1 business day | Hard stop |
Production database or destructive action Approval gate | Any data-affecting operation in production, including bulk deletion | Data owner and CIO delegate | 1 business day | Hard stop |
Major incident command Escalation | Any severity-one incident or suspected compromise | Incident commander | 15 minutes | Hard stop |
Decision ledger
Immutable record of what was decided, by whom, and how long it took.
- Escalation
Impossible-travel authentication contained
ContainedHighCyber Triage Agent detected authentication from two continents within nine minutes, suspended the session, forced re-authentication and escalated to security operations with a full indicator pack.
Cyber Triage Agent · 9d 6h ago
- Approval gate
Emergency patch window requested
PendingHighPatch Agent scored an actively exploited vulnerability against 46 exposed assets and prepared an out-of-cycle change with tested rollback.
Change board · 9d 6h ago
Requester can escalate only at this materiality - Approval gate
Privileged access request pending
PendingHighA temporary database administrator entitlement was requested for a migration window. Identity Agent assembled justification, duration and monitoring plan for identity governance.
Identity governance · 9d 7h ago
Requester can escalate only at this materiality - Notification
Known-error remediation applied at scale
Auto-executedLowIncident Agent applied an approved runbook to 214 endpoints affected by a certificate expiry, restoring service without human handling.
Incident Agent · 9d 8h ago
Kill switches
Named, tested, and reachable in one click by the accountable human.
- Credential abuse or impossible-travel authentication
- Lateral movement pattern across segments
- Abnormal command sequence issued by an agent
- Monitoring blindness or telemetry gap
- Failed rollback during an agent-prepared change
Human accountability
Cannot be delegated to an agent at any autonomy level.
- Privileged access grants and role design
- Architecture and platform standards
- Major incident command and communications
- Destructive remediation and material production change
- Cyber-risk acceptance and disclosure
Signs for this function
Chief Information Officer