Sovereign Security Architecture

In-Tenant Retrieval-Augmented Generation

Learn about our sovereign RAG model and security gating registry.

root@autonomo_soc:~$
[dir] security/
security/sovereign_rag.md

Sovereign Retrieval-Augmented Generation (RAG)

autonomo_soc leverages a secure, local RAG system to access institutional security knowledge and alert priors.

Architecture Highlights:

  • Local Embedding Vectors: Telemetry logs, past analyst classifications, alert fidelity metrics, and asset safe-lists are converted to vector tokens.
  • Encrypted State Store: Embeddings are written strictly to your in-tenant Cosmos DB RAG collection.
  • Zero Outbound AI Training: Embeddings and prompts are evaluated strictly on client-owned Azure AI Foundry models. Your corporate security history is NEVER shared, uploaded, or used for public foundation model training.

Telemetry Stream

Local RAG Vector Embeddings Logs

COSMOS_DB_RAG_VECTORIZER_AGENT [ACTIVE] 

        

      

    


    
    

      

        
core/action_policy.py [RUNTIME_ENFORCED]

        
Hard-Coded Action Policy Gating Registry

        
Enforced runtime containment safety gating parameters. Sorted descending by Risk Severity and then Min Confidence.

      


      

        

          

            
              

                Action Identifier
                Risk Level
                Min Confidence
                Reversible?
                Autonomous Mode
                Enforcement Constraint
              

            
            
              
    

      collect_investigation_package
      LOW
      50%
      YES
      AUTO
      Forensics triage package collection
    

  

    

      run_antivirus_scan
      LOW
      50%
      YES
      AUTO
      Trigger background endpoint antivirus sweep
    

  

    

      block_ip_indicator
      LOW
      70%
      YES
      AUTO
      Blacklist IP indicator in cloud firewalls
    

  

    

      block_url_indicator
      LOW
      70%
      YES
      AUTO
      Secure DNS endpoint redirection lookup
    

  

    

      block_ip_nsg
      LOW
      72%
      YES
      AUTO
      Auto-inject target vNet NSG inbound rule block
    

  

    

      revoke_user_sessions
      MEDIUM
      70%
      YES
      GATED
      Gated: Enqueues session revocation in Entra ID
    

  

    

      quarantine_email
      MEDIUM
      72%
      YES
      GATED
      Gated: Quarantines suspicious phishing emails
    

  

    

      block_file_hash
      MEDIUM
      78%
      YES
      GATED
      Gated: Defender endpoint block rule injection
    

  

    

      disable_entra_account
      HIGH
      83%
      YES
      GATED
      Gated: Hard lock client Active Directory login
    

  

    

      isolate_machine
      HIGH
      85%
      YES
      GATED
      Gated: Full local ethernet network isolation
    

  

    

      rotate_storage_account_key
      CRITICAL
      85%
      NO
      GATED
      Gated: Rotations are strictly human authorized
    

  

    

      delete_data
      CRITICAL
      100%
      NO
      GATED
      Gated: Irreversible action locked at policy level