You Cannot Approve at Machine Speed

AI-assisted intrusions can move in hours. Enterprise containment still waits on multiple owners. The answer is not blanket autonomy. It is pre-authorized, object-specific action with measurable evidence, reversibility, and accountability.

The short version

Unit 42 recently documented an intrusion in which a human-directed set of AI agents compressed activity that might normally take about two weeks into less than ten hours. The operation used more than 50 MITRE ATT&CK techniques across web infrastructure, source-code repositories, secrets, CI/CD pipelines, cloud accounts, and enterprise AI services.

Unit 42’s response recommendation included synchronized containment across four planes: revoke credentials, terminate OAuth sessions, freeze CI/CD pipelines, and isolate cloud accounts.

In many enterprises, those four actions belong to four different owners. During a fast-moving incident, nobody on the bridge may be authorized to approve all four together.

That is the gap this article addresses. The solution is not to give a model unlimited authority or to collapse legitimate segregation of duties. It is to decide in advance:

• which action may be taken;
• against which specific object;
• at what blast radius;
• on what measured evidence;
• by which role;
• with what rate limit, audit trail, abort control, and recovery path; and
• who accepts the risk when an evidence-reasonable decision produces the wrong outcome.

What follows is a five-tier authorization ladder for doing that. It is a design framework, not a deployed reference architecture. The thresholds and worked example are deliberately illustrative; they are intended to make the governance discussion concrete, not to serve as production benchmarks.

What the Unit 42 case actually shows

The attack was not fully autonomous. A human actor set objectives and made consequential decisions; specialized agents executed, shared results, and adapted. Unit 42 also clarified that the event was an intrusion, not a ransomware attack.

The speed did not come from a novel zero-day. It came from operational compression. Agents mapped internal services, searched repositories for secrets, pivoted into a secrets-management system, abused CI/CD workflows, exfiltrated cloud credentials, and used the victim’s AI infrastructure as post-compromise infrastructure. The attacker even directed the system to leave behind an 80-page technical audit of the weaknesses it had exploited.

The important lesson is not merely that AI makes attackers faster. It is that the attacker’s human sat above the execution loop. The human decided once, then delegated execution.

Defenders often put their humans inside the execution loop. A detection fires. Identity approves credential revocation. The SaaS owner approves OAuth termination. Platform engineering approves a pipeline freeze. Cloud operations approves account isolation. Each decision is individually defensible, yet the combined response moves at the speed of the slowest approval chain.

That is not primarily a detection gap. It is a delegation gap drawn on the organization chart.

Why coordinated containment stalls

Authority matters, but it is not the whole delay. Four problems usually consume the clock:

1. Scope. The instruction “revoke credentials” is not actionable until the team knows which identities, sessions, roles, tokens, and dependent services are involved.
2. Standing authority and organizational cover. The incident commander may know what should happen but lack authority across identity, SaaS, development, and cloud. Even when authority exists on paper, people may hesitate if the organization has not explicitly accepted the cost of a reasonable mistake.
3. Severity and business impact. Wider containment may interrupt customer services, financial processing, clinical workflows, or production. The decision therefore crosses from technical response into enterprise risk.
4. Reachability and execution. The authorized owner may have no console access, the engineer with access may have no authority, and both may be working from a stale call tree or through a compromised identity plane.

Pre-authorization does not eliminate investigation. It buys the interval between knowing what must be done and being permitted to do it. Sometimes that interval is only minutes. In a machine-tempo intrusion, those minutes still matter.

Scope can also be prepared in advance. A dependency map showing which identities reach which systems, which service principals sit in authentication chains, and which pipelines deploy to which accounts improves both incident scoping and safe delegation. The same work that defines blast radius can shorten the investigation that precedes containment.

The doctrine already exists; the granularity does not

Preplanned containment is established incident-response practice. NIST SP 800-61 Rev. 3 recommends considering automated containment and even authorizing service providers to take defined containment actions on an organization’s behalf. FEMA’s National Incident Management System describes written delegation of authority to an incident commander. Security products already offer graduated automation settings.

For example, Microsoft Defender for Endpoint supports several automation levels and recommends full automation for eligible environments. That is a useful product control, but it does not answer the enterprise-governance question by itself.

The missing granularity is:

Which specific action, against which specific object, at what blast radius, on what evidence, signed by whom?

“Allow automated isolation” is too broad. Isolating one test endpoint and isolating 400 production hosts are different risk decisions. Disabling a departmental OAuth application and disabling an identity dependency used across the company are not the same action simply because the API verb is identical.

The authorization must attach to the object, its dependents, and the cost of being wrong.

A five-tier containment-authorization ladder

Sort candidate actions by blast radius × irreversibility, where irreversibility includes practical recovery time. An action that can technically be undone but requires a six-hour vendor ticket is not meaningfully reversible during an active incident.

Tier	Object and decision posture	Illustrative actions	Decision holder / execution-time approval	Minimum control idea
0 — Preserve and decide	Any object. Containment may be delayed to preserve evidence or map the adversary	Capture volatile evidence; suspend automation briefly under incident-command authority	Incident commander; hunt lead holds a time-boxed veto	Time-boxed, logged decision; legal and law-enforcement constraints understood
1 — Standing	One nonprivileged human identity with no material dependents in a current, verified dependency map. Seconds to restore	Revoke one interactive session; force reauthentication	Accountable executive grants standing authority; no execution-time approver	Frozen detection, exclusion list, measured precision, immutable object resolution, rate limit
2 — Conditional	A named object with a mapped, bounded dependency set. Minutes to restore	Disable a departmental OAuth app; quarantine one forwarding rule; freeze one pipeline	Accountable executive grants standing authority; no execution-time approver, subject to the stated condition	Object and dependency map, corroborating evidence, pre-action state capture, tested undo
3 — Named role	An object class, an unmapped object, or several lower-tier actions in combination	Isolate a host group; freeze multiple pipelines; disable a production service account	Incident commander on shift, by role rather than by name	Time-boxed grant, abort control, partial-execution rule, rehearsed recovery
4 — Person, not action	Any object where the consequence is irreversible, customer-facing, or safety-critical	Actions affecting patient care, physical safety, settlement, or unrecoverable data	A named accountable person, with a documented fallback	No standing action authority; pre-authorize the decision path, reachability standard, and fallback

One caution about the sorting axis. Reversibility measures how fast you can undo an action. It says nothing about how fast the action takes effect, and those are different numbers. A session revocation may be reversible in seconds and still leave downstream access alive for the remaining lifetime of an already-issued token. Tier the action on reversibility, but record its efficacy latency beside it, because an action that takes 60 minutes to bite is not a machine-speed control regardless of which tier it sits in.

Tier 0: preserve evidence and decide whether to contain

Containment can destroy evidence: volatile memory, live sessions, infrastructure clues, or the attacker’s observable behavior. Against a stealthy intruder, a deliberate, time-bounded decision to observe before containing may be legitimate.

That decision cannot remain implicit. Decide in advance who resolves a disagreement between the hunt lead and incident commander, how long an observation veto can last, what evidence must be captured first, and when legal or law-enforcement direction overrides the normal path. Automated containment must be suppressible by that logged decision.

Tier 1: reversible, single-subject actions

Tier 1 should remain narrow: revoke one interactive session or force one user to reauthenticate. Credential rotation does not belong here; a service credential may support workloads the responder cannot see.

Tier 1 also needs explicit exclusions: break-glass accounts, identity-team administrative accounts, and accounts whose only authentication method resides on the suspected device. A global rate limit is essential so a compromised trigger cannot turn forced reauthentication into an estate-wide denial of service.

Most importantly, “the detection is high confidence” is not enough. Measure three separate things:

• Detection precision: Was the underlying security judgment correct?
• Targeting precision: Did the automation resolve the alert to the correct object, using an immutable identifier rather than a display name?
• Containment efficacy: Did the action actually remove access or stop the behavior within the required window?

These measures are not interchangeable. A correct alert can target the wrong service principal. A correctly targeted session-revocation action can still leave a previously issued token usable downstream.

Microsoft Entra access tokens commonly have a default lifetime of 60 to 90 minutes. Continuous Access Evaluation can shorten response to critical events where both the client and resource support it, but coverage is not universal. AWS, Okta, and other identity ecosystems have their own revocation mechanics and residual-session behavior. Measure the control in the environment where it will run; do not infer efficacy from the API returning success.

Standing authority should also be bound to a versioned detection. If the rule, mapping logic, or log source changes materially, the grant should suspend until the action has been revalidated.

Tier 2: conditional authority for bounded objects

Tier 2 is where object awareness becomes decisive. “Disable an OAuth app” may be a minor action for a 40-user departmental tool and a company-wide outage for an integration in a shared authentication chain.

Tier the object and its dependents. If the dependency graph is incomplete, do not halt the entire program. Default unmapped objects to Tier 3 so the unknown cases require a human, and expand Tier 2 as the map improves.

No pre-action capture means no standing authority. Before execution, export the object’s current state and the relevant decision evidence to a store the automation cannot alter. That capture is the source for both recovery and later adjudication.

Tier 2 evidence may come from a measured, stable detection or from a deliberately specified corroboration requirement—for example, two independent signals on the same principal. Keep the axes separate: the tier describes the cost of being wrong; the evidence gate describes what must be true before the action may fire.

Tier 3: wide, disruptive action by a named role

Tier 3 actions are pre-authorized but activated by a named role, such as the incident commander on shift—not by a named person and not by an ad hoc committee.

This tier requires:

• a single abort control for an in-flight sequence;
• a time-bounded grant that expires with the incident;
• a measured and rehearsed recovery procedure;
• a rule for partial execution; and
• an escalation rule when several lower-tier actions combine into a wider outcome.

The combination rule deserves to be written out, because it is what makes synchronized containment possible at all. Individually tiered actions do not stay individual during an incident. Set an explicit threshold—for example, three or more standing actions firing across different operational planes inside a defined window—above which the sequence is treated as a single Tier 3 event and requires the named role, even though every component action holds standing authority on its own. Unit 42’s four-plane recommendation is exactly this case: four separately reasonable actions whose combined effect is an enterprise-wide change nobody authorized as a whole. The threshold number is yours to set and should be tuned; leaving it unset means the ladder authorizes the parts and never the sum.

Partial execution deserves special attention. If four synchronized actions begin, two succeed, one rate-limits, and one fails, the environment is now half contained and the adversary may be alerted. Decide before the incident whether the default is to roll forward or roll back, and who may override it. The right answer depends on availability and safety obligations; the dangerous answer is leaving it undefined.

Tier 4: pre-authorize the decision path, not the action

Actions affecting physical safety, patient care, financial settlement, critical production, or unrecoverable data should not receive blanket standing authority.

But “always ask a human” is still incomplete. Pre-authorize the decision mechanism: the responsible role, the reachability requirement, the evidence package, the consultation required, the maximum decision window, and the fallback when the primary decision-maker cannot be reached.

In high-consequence environments, the irreversible action may be the only effective containment available. Tier 4 exists to make that decision reachable and accountable—not to pretend it will never be required.

The evidence gate: measure before you sign

Run candidate Tier 1 and Tier 2 actions in shadow mode before granting standing authority. Record what each action would have done, resolve the intended object, and have analysts adjudicate the result. A 90-day window may be useful for recurring detections, but the appropriate duration depends on firing frequency, seasonality, and change rate.

Shadow mode can estimate firing frequency, detection precision, targeting precision, and the operational cost of incorrect actions. It cannot, by itself, measure recall or containment efficacy.

Recall requires controlled testing: purple-team activity or injected scenarios that create the conditions the detection is meant to identify. Efficacy requires a safe probe that attempts the prohibited behavior after the containment action. For token-mediated controls, that could be a canary identity and an automated check showing how long downstream access survives after revocation.

Shadow mode tells you what an action would have done. It does not tell you whether that is good enough, and no external threshold can, because the right precision bar is a function of your firing frequency, the cost of one wrong action at that tier, and how fast you can undo it. Derive it rather than importing it.

Expected wrong actions per year is firing frequency × (1 − precision). Multiply that by the fully loaded cost of one wrong action—the outage minutes, the people pulled in, the customer impact. Compare the result against the expected loss avoided by acting in minutes rather than hours. If the first number exceeds the second, the action does not belong at that tier no matter how good the precision looks in isolation. A Tier 1 action that fires weekly at 96% precision produces roughly two wrong actions a year; if each costs a re-authentication prompt, sign it. If each costs a production incident, it was never a Tier 1 action.

For material actions, include measured containment efficacy on the avoided-loss side, and do not run the calculation on the point estimate. The difference is not academic. Fifty-one correct decisions out of fifty-three is a 96.2% point estimate, but the approximate 95% interval runs from about 87.2% to 99.0%. Use the 87% lower confidence bound as the conservative planning case, then stress-test clustered failures and deterioration following detection, model, or telemetry changes.

The evidence should be captured contemporaneously in a decision record:

• trigger and detection version;
• evidence available at execution time;
• object resolved and method of resolution;
• action, condition, tier, and rate limit;
• pre-action state capture;
• execution result and containment confirmation;
• recovery procedure and last rehearsal time;
• signer, accountable executive, and recertification date.

A risk committee is far more likely to approve a bounded statement such as “this version fired 53 times, was wrong twice, targeted the right object every time, and can be undone in five minutes” than a vague request to “automate containment.” The numbers will differ by environment. The principle is to convert automation from an aspiration into an auditable risk decision.

Committees accept risk in a particular shape, so write the entry in that shape rather than attaching the framework. Something close to: “Risk: pre-authorized containment actions execute without contemporaneous human approval, and may cause self-inflicted service disruption or be abused at scale if the triggering system is compromised. Controls: tiered object inventory with measured detection precision, targeting precision, and containment efficacy; exclusion list; authorization boundary enforced in platform controls outside the model; per-tier rate limits; append-only decision record; abort control and time-boxed grants; quarterly rehearsal with timed undo. Residual: accepted within appetite only for the versioned action-object grants recorded in the approved authority register; no blanket acceptance is granted by tier. Owner: [named executive]. Review: annual, on change of owner, and on any change to the tiers.”

A compact worked example

The following authorization record is fictional. Its purpose is to show the specificity required.

Field	Illustrative entry
Object	Departmental contract-review OAuth application; 41 users
Dependents	Reads one SharePoint site; no mapped downstream token consumer; last verified 12 Aug 2026
Action	Disable the service principal and revoke grants
Tier	Tier 2 — conditional
Trigger	New device/IP pair plus token issued outside the normal consent flow
Evidence gate	Versioned detection; corroborating identity signal required within 30 minutes
Detection precision	96.2% point estimate — 51 of 53 firings adjudicated correct over 118 days in shadow mode. Approximate 95% interval 87.2%–99.0%; the authority was signed against the lower bound
Targeting precision	No object-resolution errors observed across those 53 firings, which bounds the error rate at roughly 5.7% and no tighter
Containment efficacy	Canary probe, monthly: downstream access ended within 4 minutes median, 11 minutes worst case over six months
Targeting	Resolve by immutable object ID, never display name
Pre-action capture	Consent state, token issuance, and sign-in evidence exported to append-only storage
Rate limit	Two executions per object per 24 hours; repeat event escalates
Signer	Director of Identity under risk-committee-approved standing authority
Undo	Re-enable the service principal and restore documented prior consent state from the pre-action capture; admin re-consent required
Undo last timed	4 minutes 20 seconds, rehearsed 27 Aug 2026; next rehearsal due 27 Nov 2026
Recertification	Quarterly and after any material detection or dependency change

If the team cannot complete a field, the action does not yet have standing authority. It has a runbook entry and more engineering work to do.

Treat the automation itself as an attack surface

Pre-authorized containment becomes a weapon if an attacker compromises the system that triggers it. A malicious or manipulated workflow could inherit permission to revoke credentials, isolate hosts, and disable production services at scale.

At minimum:

• enforce the authorization boundary in deterministic platform controls outside the model;
• keep the model or detection engine from expanding its own authority;
• log decisions and actions to storage the automation cannot modify;
• use least-privileged, short-lived execution identities;
• rate-limit each tier and object class;
• require an abort control independent of the executing workflow; and
• monitor the automation path as a privileged production system.

Natural-language reasoning may inform a recommendation. It should not be able to negotiate with or rewrite the authorization boundary.

Design for a compromised control plane

The ladder assumes that identity, EDR, logging, and automation control planes are trustworthy. The incident that most needs standing authority may invalidate that assumption.

Define a degraded mode in advance. If the identity provider is suspected, suspend standing actions that depend on it—even low-tier actions—and name the non-federated paths that remain available. If out-of-band logging fails, tighten authority because the organization can no longer reconstruct the action.

Specify entry and exit criteria. Useful entry signals may include unexplained changes to signing keys or federation configuration, anomalies on identity administrators’ accounts, or an ingestion gap affecting the decision log. The incident commander may declare degraded mode, but a separate control owner should verify exit after the compromised plane has been rebuilt or independently validated.

Then test the supposedly independent path. A break-glass account synchronized from the compromised directory is not independent. A pipeline token governed by the same federation trust is not independent. A network console using centralized authentication against the failed directory may not be independent either.

For every degraded-mode action, document the execution path, credential owner, credential location, failure condition, and last rehearsal. The critical test is not whether the runbook exists; it is whether someone can still authenticate and use it when the primary control plane is unavailable.

Protect evidence-reasonable decisions

The hardest approval is not technical. It is organizational:

When a pre-authorized action fires correctly on the evidence available but produces the wrong outcome, how will the organization judge the person who approved the authority?

If every adverse outcome is treated as proof that the signer should have known better, the program will regress to manual approval. Durable authority needs a just-culture mechanism that separates an evidence-reasonable decision from reckless or out-of-scope action.

That mechanism should include:

• A forum, not personal reassurance. Record the accepted risk through the appropriate executive or risk committee, with a named accountable owner and review cadence.
• A defined test. Ask whether a similarly trained peer, with the same information and under the same time pressure, could reasonably have made the same decision.
• An independent reviewer. The reviewer should not own the direct financial consequence and should not be auditing a control they designed.
• A fixed trigger and sequence. Review every material firing from the contemporaneous decision record, not only the cases that generate complaints.
• An honest statement of protection. Define what the organization can commit to for reasonable decisions while acknowledging that regulators, courts, employment law, and individual-accountability regimes remain outside a committee’s power to waive.

The same process should examine false negatives. Organizations often attach a name to the disruptive false positive but not to the decision to leave a high-confidence action manual while an intrusion continued. Both are risk choices.

What else must agree

A technically sound ladder can still fail outside the SOC. Before granting standing authority, check:

• MDR or MSSP contracts: Does the agreement permit the provider to isolate, revoke, or disable? Who bears outage cost, and what evidence and escalation are required?
• Cyber insurance: Could a self-inflicted interruption affect coverage, notification, or consent obligations? Obtain written guidance from the broker or insurer.
• Employee representation and privacy: Automated action against an employee account may create consultation, monitoring, or automated-decision questions depending on jurisdiction and consequence. Involve employment counsel and the privacy office.
• Customer and service commitments: Containment in a shared or multi-tenant environment may affect customers who did not authorize the action and may trigger service-level or notification duties.
• Change management: Register the authority as a pre-approved emergency-change class so routine controls do not block execution during an incident.
• Regulatory reporting: Internal severity labels do not necessarily start every legal clock. For example, NIS2 uses awareness of a significant incident for its early-warning timeline; DORA’s reporting standard ties its initial notification to major-incident classification with an awareness backstop; and the SEC requires materiality determinations without unreasonable delay. Treat these as counsel-led requirements, not SOC severity shortcuts.
• Operational technology: Below the IT/OT boundary, safety, process control, and availability may dominate. Reuse the decision architecture, but do not transplant the IT tiers or actions without plant operations and safety leadership.

These considerations may delay or condition implementation. That is not an argument against pre-authorization; it is the work required to make the authority real.

The control that held

One detail in the Unit 42 case deserves more attention. The attacker attempted to plant backdoors in Terraform configuration, but hard branch-protection controls stopped the change.

No model debated the request. No new execution-time approval was required. A decision had already been encoded as a control.

A decision encoded in advance can execute at any speed. A decision first taken during the incident executes at the speed of whoever is awake.

That does not mean every decision should become automation. It means the organization should deliberately decide which decisions can be encoded, which require a named role, and which must remain with an accountable person.

The test for CISOs and incident leaders

Name the owners who would have to approve these four actions in your organization:

1. revoke credentials;
2. terminate OAuth sessions;
3. freeze CI/CD pipelines; and
4. isolate cloud accounts.

Multiple owners are not the problem; segregation of duties is legitimate. The question is whether a declared incident has a single, pre-delegated activation path that can coordinate those owners and actions within a defined window.

If it does not, synchronized containment is still a conference call with a good playbook attached.

Start with a small set of well-understood objects. Map dependencies. Run shadow mode. Measure detection, targeting, and efficacy separately. Record the accepted risk. Test the abort and undo. Rehearse the normal and degraded paths with a clock running. Expand only as the evidence earns wider authority.

Attackers do not carry your availability commitments, safety duties, customer contracts, works councils, regulators, or audit committee. That asymmetry cannot be automated away. The purpose of the ladder is to make legitimate constraints executable before the incident—not to discard them when the incident begins.

---

Note. This is independent analysis, not legal, regulatory, insurance, employment, or safety advice; validate every tier against your own architecture, contracts, and counsel. The Unit 42 case is a vendor-published account of one investigation, has not been independently verified here, and one incident is not a baseline.

Selected sources

1. Palo Alto Networks Unit 42, “An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation”, published 2 September 2026; updated 3 and 4 September 2026.
2. NIST, SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
3. FEMA, National Incident Management System, third edition.
4. Microsoft Learn, Automation levels in automated investigation and remediation.
5. Microsoft Learn, Secure applications with Continuous Access Evaluation.
6. AWS, Revoke IAM role temporary security credentials.
7. European Union, Directive (EU) 2022/2555 (NIS2).
8. European Union, Delegated Regulation (EU) 2025/301 (DORA incident-reporting timelines).
9. U.S. Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure.