Ask a reasoning agent the same question twice and you may get two different answers. Both might be good answers. They might cite the same evidence, reach the same conclusion, and still phrase the journey differently. For investigation, this is fine, even useful. For response, it is disqualifying. Nobody wants to explain to an auditor that the account got disabled because the model was feeling thorough that day.
This is the central design tension in agentic security automation, and much of the industry has converged on the same broad answer: put guardrails around the agent and keep a human near the trigger. Good. The seam between creative investigation and disciplined response is becoming table stakes, and it should be. What separates implementations is what sits on each side of that seam, what is allowed to cross it, and what you can prove about a crossing after the fact.
Let the agent be creative about finding the truth. Never let it be creative about what happens next.
Two jobs, two contracts
An investigation is judgment work with an open world. Which logs matter? What does this PowerShell actually do? Is this sender weird for this org? Agents are genuinely good at this: they read broadly, chase context a flowchart would never encode, and assemble evidence at a depth a tired analyst cannot sustain at 3am. The output of this phase is not an action. It is a case file: indicators, enrichments, observations, and a reasoned conclusion with its confidence stated.
A decision is the opposite kind of work. It has a closed world by design: here is the evidence, here are the thresholds the team set, here is the action that follows. This layer should be boring. Given the same case file and the same configuration, it must produce the same call, every time. That property is what makes the call defensible, and it is what makes it testable before it ever touches production.
What the seam looks like
In Soarcery, the seam between the two layers is explicit. The agent investigates and produces structured findings: verdict spreads on the indicators, the evidence chain, a conclusion with its confidence stated. The decision layer evaluates those findings against rules a human wrote and can read: each agent's charter, the written scope of what it is allowed to do, and which actions always wait at an approval gate. Yes, this layer is the part that looks like a playbook, and that is deliberate. It is small, it never investigates, and it is the only part that touches the trigger. The maintenance burden that killed playbooks lived in hand-encoding the investigation; a decision layer that only maps structured findings to outcomes can stay a page, not a library.
- The agent proposes. Its findings and reasoning go on the record, in full.
- The decision layer disposes. Explicit logic maps findings to an outcome: close, contain, escalate, or wait for a human.
- The gate holds. High-blast-radius actions queue for approval no matter how confident anyone upstream was.
The practical consequence: given the same case file and the same configuration, the decision layer produces the same call, and the rule that fired sits on the record next to the evidence it fired on. We treat divergence in that property as a severity-one bug, because it is the audit story. When something looks wrong, you are not debugging a vibe. You are reading a rule.
The seam is also a security boundary
There is a sharper reason to keep the trigger away from the agent: the agent reads attacker-controlled text for a living. Email bodies, macro code, fetched pages, all of it lands in the investigation, and some of it will eventually be written to address the model directly. Prompt injection aimed at AI analyzers has already been observed in malware samples in the wild. The split architecture is the containing structure for exactly this. Agent findings are treated as untrusted input. The decision layer acts only on structured fields, evaluated against rules no model can edit. And the highest-blast-radius actions wait at the gate regardless of what the case file says. A compromised investigation can corrupt a conclusion; it cannot widen its own authority.
Why not just a better-behaved agent?
A tempting shortcut is to keep one agent end to end and prompt it into discipline: "always follow the runbook, never act without high confidence." The model usually complies, and "usually" is exactly what you cannot build a floor on. The stronger versions of this idea, typed action schemas and per-tool permissioning, are real improvements, and they belong inside the investigation layer too. But a permission system the model operates within is still a fence around the trigger, not a separation from it. A response system that is right about its own restraint most of the time has no floor under it, and the exceptions arrive in production, at the worst hour, with no rule to point at afterward.
Putting determinism in a separate layer is an architectural floor, not a patch on model behavior. The agent cannot improvise past it, because the agent is not the thing holding the trigger.
The trust ramp this enables
Teams will not adopt autonomy because a benchmark told them to, and they should not. The only ramp that works is evidence from their own environment with the gates on: start with every action gated, read the decision trail, then widen autonomy exactly where the record has earned it, one use case at a time. The split architecture is what makes that ramp coherent. The agent never gets more creative. Your configuration gets more permissive, at the speed of your own evidence.
Want to see the seam in the product? Request Demo and ask to watch a contested verdict route to the approvals queue.