AGENT-L

AGENT SOC_ANALYST {
    GOAL containment { MAINTAIN threat.status == contained }

    OBSERVE { threat.status asset.criticality suspected_host }

    TOOL isolate_endpoint {
        INPUT  { host: String BIND suspected_host }
        RISK   { operational = HIGH }
        EFFECT { threat.status = contained }
        COST   8
    }

    POLICY {
        DEFAULT DENY
        ALLOW isolate_endpoint IF threat.confirmed == yes
        NEVER isolate_endpoint WHEN asset.criticality == CRITICAL
    }
}