Detection Confidence as the Authorization Gate: Integrating the Detection Lifecycle Codex and Agentic Security Governance Framework into a Closed-Loop Autonomous SOC Architecture

Abstract

Autonomous response should not be triggered merely because a detection fires. This paper proposes detection confidence as an authorization gate that determines whether a security action may execute automatically, requires human review, or must be held. Two frameworks are specified to make that gate operable. The Detection Lifecycle Codex governs a detection from use-case definition through telemetry contract, adversarial validation, confidence calibration, authorization classification, runtime assurance, and retirement, and it assigns each detection an authorization class rather than a severity label. The Agentic Security Governance Framework governs the security agents that recommend or execute response, controlling identity, tool permissions, action boundaries, approval requirements, and rollback. A closed-loop architecture integrates the two: evidence is assembled, confidence is assessed across six independent dimensions, action risk is classified separately, and a policy decision point outside the agent's trust boundary arbitrates between them before anything executes. Outcomes are recorded and returned to confidence calibration and authorization policy. The arbitration rule is asymmetric by design, in that confidence can only authorize consideration of an action and never overrides the action-risk class, so no confidence score unlocks an irreversible operation. The architecture is specified and evaluated analytically. It is not reported as a measured production deployment, and the paper states which quantities remain unmeasured and what a controlled pilot would have to produce.