Under attack? Tell a human responderReport an incident →
Approval Gates

The agent proposes. Your people decide.

Investigation is autonomous. Changes to your environment are not. Every response action waits for a named person, inside a time window, with the evidence in front of them.

irate / reviewed actionsample data
Reviewed action · Microsoft Sentinel incident
Current
Status: Active
Classification: Not set
Owner: Unassigned
Proposed
Status: Closed
Classification: True positive
Confirm in MicrosoftProposal expires in 15 min · re-checked against live state before applying

Autonomy should be earned, one action at a time.

We start every action type at “recommend only”. Autonomy expands only where the record shows analysts agree with the agent and the action demonstrably worked.

01

Nothing changes without a yes.

LIVE

Any verdict that isn’t clearly benign is held as awaiting approval. If nobody answers inside the window, it closes as “no response” and is recorded. Nothing is actioned silently.

  • Approval window set per client
  • Automatic expiry with an audit record
  • Workflow execution blocked by default
irate / incident queuesample data
Open incidents72 critical
Alerts · 30d1,28441 in last 24h
AI auto-triaged1,219of 1,284 · 95%
DetectionSeverityEntityVerdict
Credential dump on build runnercriticalBLD-RUN-04Malicious
Malicious link clickedhighFIN-WS-01Needs approval
Impossible travelmediumakhanBenign
Unsanctioned SaaS uploadhighMKT-LT-22Needs human
Privilege escalation (cloud)criticalci-deployerMalicious
02

Propose, re-check, confirm.

LIVE · MICROSOFT

A reviewed action shows the current state next to the proposed change. Before it applies, Irate re-reads the live system; if someone changed it meanwhile, the proposal is refused as stale. Applying twice does nothing twice.

  • Current vs proposed, side by side
  • Short-lived proposals tied to one reviewer
  • Idempotent apply
irate / reviewed actionsample data
Reviewed action · Microsoft Sentinel incident
Current
Status: Active
Classification: Not set
Owner: Unassigned
Proposed
Status: Closed
Classification: True positive
Confirm in MicrosoftProposal expires in 15 min · re-checked against live state before applying
03

Coming next: earned autonomy.

COMING NEXT

Per action type, Irate will track how often analysts override the agent and how often approved actions are confirmed to have worked. Only then will it offer to move that action from approved to autonomous.

Keep going
See it on your alerts

Bring us your backlog.

Thirty minutes, no slideware. Watch Irate work last week’s alerts on your own data.