Human-Governed, AI-Assisted Triage and Remediation in Cloud Security Operations

Abstract

Cloud security assistants can produce plausible recommendations from stale ownership records, incomplete evidence, or unsuitable precedents. When those recommendations lead to production changes, the system needs a rule for assigning decision authority. The framework presented here scores each task on consequence, reversibility, evidence quality, time sensitivity, and policy clarity. The lowest score determines whether the assistant may execute the task, recommend it for approval, or support a human decision. Tasks outside the approved purpose follow a separate human process. An evidence-linked case brief records the facts supporting the decision, and approval applies to a specific plan that must be checked before execution. Nine constructed cases examine the rule's behavior. Lowering any criterion cannot increase autonomous authority. A numerical counterexample also shows why aggregate acceptance rates can conceal overreliance. The evaluation protocol measures conditional reliance, final decisions, service impact, and containment time. Deliberately incorrect recommendations are restricted to controlled simulation; operational effectiveness and long-term skill retention require measurement.