Human-in-the-Loop

AuroraSOC follows a human-in-the-loop (HITL) philosophy: AI agents handle the heavy lifting of analysis and correlation, but critical decisions require human authorization. This ensures accountability and prevents AI from taking irreversible actions without oversight.

When Humans Are Involved

Action Classification

Category	Actions	Approval Required
Read-Only	SIEM search, IOC lookup, log correlation, MITRE mapping	Never
Low-Impact	Create case, add timeline entry, generate report	Never
Medium-Impact	Block IP, run scan, enrich IOC	Only for critical assets
High-Impact	Isolate host, disable user account	Always
Irreversible	Revoke certificate, delete data	Always, with 2-person rule

Approval Workflow

Creating an Approval Request

When an AI agent determines human approval is needed:

Approval Record

Each approval request stores:

Field	Description
ID	Unique approval identifier
Case ID	Linked investigation case
Action Type	What action requires approval
Justification	AI agent's reasoning for the action
Context	Relevant alert/case data
Requested By	Agent type that requested
Status	pending / approved / rejected / expired
TTL	Time-to-live (default: 4 hours)
Decided By	Human analyst who approved/rejected
Decision Time	When the decision was made

Approval States

Timeout Handling

The scheduler runs an approval expiration check every 2 minutes:

# From aurorasoc/services/scheduler.py
async def _expire_approvals():
    """Expire approvals older than TTL."""
    cutoff = datetime.utcnow() - timedelta(hours=4)
    expired = await db.query(
        HumanApproval.status == "pending",
        HumanApproval.created_at < cutoff
    )
    for approval in expired:
        approval.status = "expired"

When an approval expires:

1. The requesting agent receives an "expired" status
2. The agent determines an alternative path (usually escalation)
3. An audit entry is created noting the missed approval
4. If the action was time-critical, the agent may create a new request with elevated urgency

Configuring TTL

The 4-hour default assumes 24/7 SOC staffing. For organizations without around-the-clock coverage, consider:

• Increasing TTL to bridge off-hours periods
• Setting up escalation chains so approvals route to on-call staff
• Pre-approving certain action types during business hours

Audit Trail

Every human-in-the-loop interaction is logged to the AgentAudit table and the aurora:audit Redis stream:

{
  "timestamp": "2024-01-15T12:07:30Z",
  "event_type": "human_approval",
  "agent_type": "incident_responder",
  "action": "isolate_host",
  "target": "workstation-0042",
  "decision": "approved",
  "decided_by": "analyst@soc.company.com",
  "justification": "Host confirmed compromised via lateral movement",
  "response_time_seconds": 195
}

This audit trail provides:

• Compliance evidence for regulatory audits (SOC 2, ISO 27001)
• Performance metrics — analyst response time to approval requests
• Training data — historical decisions for future automation tuning

Why Not Fully Automate?

The question always arises: "If the AI is confident, why require human approval?"

1. Legal liability — Isolating a production server has business impact. Humans must authorize.
2. False positive risk — Even at 95% confidence, 5% of isolated hosts would be wrong.
3. Context the AI lacks — A scheduled maintenance might look like an attack to the AI.
4. Trust building — Organizations adopt AI incrementally. HITL builds trust over time.
5. Regulatory requirements — Many frameworks mandate human oversight for critical actions.

AuroraSOC is designed so that as trust increases, the approval thresholds can be adjusted to allow more autonomous action.