Skip to main content
SDAs are designed for gradual trust-building. You control how much autonomy the agent has at every stage.

​
Phase 1: Manual

The agent investigates incidents and suggests response actions, but a human analyst must review and approve every action before execution. Best for: Initial deployment, building confidence in agent judgment, high-sensitivity environments.

​
Phase 2: Automatic

The agent automatically executes Gamebook actions based on severity thresholds you configure. High-severity incidents might still require human approval, while medium and low can be handled autonomously. Best for: Teams comfortable with agent decisions on routine incidents, scaling SOC capacity.

​
Phase 3: Full Autonomous

The agent handles complete Gamebook execution without human intervention across all configured severity levels. Humans are notified but not required to approve. Best for: Mature deployments where agent judgment has been validated through Phases 1 and 2, maximum speed of response.

​
Transitioning Between Phases

You can change the operating mode at any time in Agent Center → Agent Configuration. There’s no minimum time requirement for each phase — move at whatever pace your team is comfortable with.
Most organizations spend 2–4 weeks in Manual mode, 4–8 weeks in Automatic, before considering Full Autonomous. Review execution history regularly to validate agent decisions.