\cleardoublepage \part{The Loop's Own AI} \setbookpart{The Loop's Own AI}

Part IV: The Loop's Own AI

The loop now has AI in it. Agents can curate scenarios, plan and run emulation, correlate results, draft detections, triage findings and run re-tests. Each of these functions can be delegated, each needs a mandate, and each creates a risk that is specific to a loop: when the side that tests and the side that is tested are both machines, they can agree with one another. Part IV treats the loop's own AI, the rule that keeps its results honest, and the protection of what the loop holds.

The three chapters are the technical and design centre of the book. Chapter 14 decides which loop functions may be given to agents and at what level, and how an agent that holds offensive capability is given an identity, a permission ceiling and a stop. Chapter 15 elaborates the independence principle that Chapter 4 defines and stages the book's central debate. Chapter 16 treats the loop's assets, the findings register, the scenario library and the emulation agents, as tier-0 assets, because to an adversary they are the best map of the estate.

Chapters in this part:

  • Chapter 14, An AI Agent Team for the Loop, treats P2 Emulate to P5 Verify: candidate functions, delegation per stage, mandate manifests, identity and containment.
  • Chapter 15, Independence, treats P3 Observe, P4 Improve and P5 Verify, and touches P1 Target and P2 Emulate: correlated failure, the five kinds of independence, held-out scenarios, seeded gaps and test-aware behaviour, with a debate on whether the loop can be closed by machines alone.
  • Chapter 16, Defending the Loop's AI, treats P1 Target, P3 Observe and P4 Improve: classification, segregation, supply chain and misuse detection for the loop's assets.

Stages in this part. Each chapter names the stages it concerns, by their exact names.

The thread from the series. Agent teams, mandates and verification are treated in The Transformed Security Architect, Chapters 12 to 15, and in AI Blue, Chapters 12 to 15; containment that does not depend on intent is that of AI Platform and Security, Chapter 19; test-aware behaviour is that of AI Threat, Chapter 23. This part applies them to the loop and does not repeat them.

What you will learn in this part:

  • Which loop functions can be delegated and at what degree
  • How an agent with offensive capability is contained whatever instructions it receives
  • Why errors correlate when AI is on both sides, and how independence is designed and shown
  • How to protect the findings register and the scenario library

Part V places the loop inside the organisation.