I built a personal experiment in which an AI assistant investigates a security incident and asks a person before taking a proposed containment action.
I built an assistant that uses three tools to investigate security alerts. It uses Gemini 2.5 Flash and pauses for human approval before actions that could disrupt systems.
I explored where an automated investigation should stop and ask a person.
The agent can reason about a threat, but it should not act on production infrastructure unsupervised. Sentinel keeps a human in the loop on every destructive action.
A full triage of incident INC-4471 — the agent scans the logs, enriches the threat intel, and proposes containment, then stops at the human-approval gate before anything executes.
Recorded from a live run against Gemini 2.5 Flash. Or run it yourself — open the live demo →
Three tools that match what a Tier-1 analyst does to triage an incident.
A ReAct loop: the agent thinks, calls one tool, reads the result, and repeats — narrating each step into a live thinking log. When it wants to contain a host, it stops and waits for a person.
Severity: Critical. Outbound beaconing and possible data exfiltration from FIN-WKSTN-08 to a known malicious Tor exit node / C2 relay (185.220.101.47).
Abnormal traffic volume — 188 connections, 1,920,044 bytes egress — to port 4444. The node was quarantined after operator approval.
The verdict above. The full run that produced it, below.
Ten steps · three tool calls · one approval. The agent reasoned through the evidence before proposing the destructive action — and the loop stopped on its own at step 8 because quarantine_host is declared destructive in the tool schema. The model didn’t bypass the gate; the schema made it unreachable without approval.
It acts on a company's infrastructure, so the design assumes the agent can be wrong. Three decisions keep a person in command.