GRCLibrary.ai

Framework

Agentic Response State Model Framework

This framework defines a state model for automated (agentic) response to a detected condition (a security event, an operational anomaly, a policy breach). The corpus governs the human incident lifecycle (ai/plan-ai-incident-response.md) and requires human review before containment (operations/procedure-threat-intelligence-and-siem-operations.md), but it has no state machine for what an agent may do autonomously between detection and human authorization. This framework supplies that: the states an agentic response moves through, the transitions between them, and, at each transition, the containment-authority boundary that separates what the agent may do within its existing observation-and-analysis grant from what requires a further human grant.

Type
Framework
Version
0.0.4
Date
2026-09-20
Owner
AI Governance Approver
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
AI Governance
Review frequency
6 to 12 months and upon material AI, threat, or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • The state model
  • State transitions and the containment-authority boundary
  • Alignment with the human incident lifecycle
  • Assurance requirements
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents