Human in command
How Cyberdroid, analysts and ARRTECH SOAR share the work.
How the work flows
AI Investigation can gather evidence and prepare a case for an analyst to review. Accepting that assessment is separate from authorizing a response. The record connects the delegated work, its evidence and the people responsible for each decision.
Workflow steps
-
Request by email
A person asks by email, and software checks the request against policy.
-
Administrator approval
An administrator approves each task before an agent starts it.
-
Agent questions
An agent that needs a decision asks the right person.
-
Acceptance of results
A person reviews and accepts the finished work.
-
DLP and SOAR approvals
SOAR pauses a playbook at each step the team marks for approval. DLP can hold a file or message for a manager.
Accountability and status
Accountability
People define the work and authority they delegate, then remain able to examine the result and intervene. The operating record makes those responsibilities visible.
Status
Delegated work and Cyberdroid AI Investigation are in early access.
Records
Each step is recorded.
Tasks
Each approval, question, acceptance and reopening is recorded with its author.
Playbooks
ARRTECH SOAR's history shows who chose what, and when.
Request outcomes are covered on Agent permissions.
Standards
Naming a clause is not a claim of certification.
EU
Article 14 of the EU AI Act asks that people can monitor, interpret, override and stop a high-risk system.
NIST
AI RMF MAP 3.5 asks for documented human review, and MANAGE 2.4 for a way to disengage a system.
