Agentic Cyber Resilience Platform Administration
Agentic Cyber Resilience Platform Administration tests operating a platform where AI agents assist with detection, triage, and recovery. You must govern agent permissions, data access, human approvals, auditability, and lifecycle while keeping resilience workflows reliable.
Core rules
- Apply least privilege to agents and service accounts. Scope each agent to specific data sources, actions, and environments.
- Require human-in-the-loop approval for destructive actions: containment, deletion, credential reset, and production failover.
- Define guardrails: allow and deny action lists, change windows, rate limits, approval chains, and rollback.
- Log prompts, decisions, tool calls, and approvals. Retain audit trails and review for drift.
- Monitor agent health, token expiry, API quotas, and false positives. Retire stale agents and rotate secrets.
Worked example
You deploy an agent to triage suspicious backup anomalies. Give it read-only access to anomaly alerts and backup metadata, not restore rights. Configure a workflow where the agent proposes a recovery point and evidence, a platform administrator approves, and the platform executes a restore to the clean room. Log the proposal, approval, and result. After 30 days, review the false-positive rate and tighten scope. If the agent requests broad tenant read access, reject the request and re-scope.
Traps that cost marks
Over-permissioned agents. No approval for destructive actions. Ignoring audit logs. Letting agents use shared administrator credentials. Having no rollback plan.