“Human in the loop” often means a human clicks approve on everything, which quickly becomes a human rubber-stamping everything. The better design gives the manager precise control over where the agent is autonomous, then lets it get on with the job.
Four levels, set per device group and per task
- Off: the agent doesn’t touch it.
- Monitor: it watches and reports, and changes nothing.
- Ask: it prepares the change with plan, risk and rollback, and waits for one-click approval.
- Auto: it acts, verifies and records.
The matrix is the key: workstation patching can be Auto while server patching is Ask and the firewall is Monitor-only. In Vantage Guardian the manager sets this on an admin page, with presets to start from.
Controls that match real operations
- Time windows: auto-patch servers only between 02:00 and 04:00.
- Expiring grants: full control of one firewall for four hours during a migration, then back to normal automatically.
- Emergency containment: during a confirmed live attack the agent may isolate a host or block an address even where it would normally ask, and pages the manager immediately. Managers can switch this off.
- Protected devices: domain controllers, the gateway and the agent’s own box are never contained automatically.
- Change freeze and kill switch: pause everything, or revoke every credential, in one action.
The rules must not be the AI
A permission system is only as strong as its weakest input. In early security reviews of Guardian we found that an agent could, in principle, describe a domain controller as a “workstation” to borrow the workstation’s Auto rights, or declare its own emergency. The fix is a principle: trust is granted, never assumed.
- Device groups come from the inventory, never from the model.
- Priorities and emergencies come from triage rules, never from the model.
- Approvals are single-use and tied to the exact settings that were approved.
- Low-confidence actions are downgraded from Auto to Ask automatically.
- The agent may lower its own autonomy, never raise it.
Some actions stay human, whatever the settings
Firmware upgrades, deleting users or mailboxes and backup restores are never automated. The agent prepares the steps and a rollback plan; a person runs them. Hard limits (its own audit trail, its own permissions, its monitors, destructive wipes) can’t be unlocked by anyone.
Earn autonomy with evidence
New clients start in a monitor-only observer phase. The daily diary shows what the agent would have done, with evidence, so the manager can grant permissions based on its record on their own network. See how setup works.
Want Guardian on your network? Join early access as a design partner.