Solace investigates. The analyst decides whether to believe it.
Arclight · UX + AI Product Design · Systems Design
Arclight is a Security Operations platform for teams working alongside autonomous agents. Solace runs the first-pass investigation and hands the analyst a decision-ready case, built by specialist agents she never has to manage directly. What happens after that handoff, whether she trusts it, overrides it, or signs off on it, is what most of this case study is actually about.
Duration
4-week sprint
Methods
Figma · Claude Code, FigJam
A self-directed conceptual project exploring SOC design for agentic AI. Not affiliated with, built for, or deployed by any real financial institution.
The real problem: the alert that gets dismissed is the one that might matter.
Security teams don't need more ways to find alerts. They already have more signals than they can reasonably investigate. The challenge is deciding what deserves attention when most alerts appear routine and a small number carry real risk.
This case study follows a single shift decision
An encoded PowerShell execution that Solace recommends blocking at 61% confidence, with a window for analyst review before the action becomes permanent. Most decisions like this are straightforward. This one sits in the space where evidence is meaningful but not enough to remove human judgment.
Maya is a Tier 2 analyst at a global bank SOC, where the stakes are specific. Isolating a host can interrupt critical operations and every automated decision needs to remain explainable and defensible during review.
Design the decision path first, then build seven specialists to run it.
Solace is an orchestrator, not a single generalist agent. Seven specialists do the actual investigating; Solace synthesizes what they find into one voice instead of relaying raw, disagreeing outputs. The lifecycle underneath follows the standard agentic shape, perception, planning, action, handoff, memory and the workflows below show what each phase looks like once a case is actually moving through it.
That's the whole path a case takes. The specialists feeding Planning are one box in that diagram, here's what's actually running inside it:
She's always available to ask something of, the badge just says 'What do you want to know?' Most of a shift she works quietly in the background: an informational pill lets Maya know something's forming, without asking anything of her yet. When it actually needs her judgment, the pill says so directly. The pill itself stays generic on purpose, it's a signal, not a conversation. Click it, and that signal becomes an actual colleague talking through her read.
Meet Solace, your shift partner.
Ambient
Always there to ask. Heads-down, correlating, executing approved low-risk actions in the background. Click anytime, no urgency required.
Insight
Nothing needed yet. Just visibility that Solace is paying attention and something's taking shape, before it's anyone's problem.
Notice
Her judgment is actually needed now. The pill names it before she ever opens the card.
Critical threats skip this whole progression. No pill, no graduated escalation, straight to a blocking modal because some things can't wait for a badge to change color.
Bloom Card
That's not a status update. It's a coworker explaining what she's confident about, what she isn't, and where she needs Maya specifically.
Three moments, each a different phase of the same lifecycle in practice.
Triage: TRDR-114
Solace grouped three signals into one case, an LSASS dump on a trading engineer's machine plus lateral movement to two other endpoints. The access signature matches a known credential-refresh pattern, so intent is ambiguous from telemetry alone.
What's confirmed is that the lateral movement touches endpoints with no trading relationship and that's Maya's actual basis for acting.
Two actions, not four: Monitor only or Override hold. Fewer choices under pressure means a faster call, not a slower one.
Governance: host-14
Outbound traffic to a known-bad IP, confirmed command-and-control, 84% confidence. Solace isn't uncertain here, it already staged containment.
What's different is how much process the human step requires: governance policy requires a formal sign-off before Tier-2 containment, independent of confidence.
One action: Approve containment.
Learning: Pattern Review
Solace surfaces what it handled overnight, then proposes moving a specific pattern toward full autonomy. Maya approves, rejects or adjusts the threshold herself.
Not every pattern gets that offer: a known backup script can graduate toward silence but a judgment call like the TRDR-114 override never does, no matter how many times Maya makes the same call.
Two places where the harder call was to hold something back, not to add more capability.
Separate the System From the Decision
Not every layer of transparency belongs in the primary workflow. Early designs exposed every specialist agent involved in a recommendation, but that shifted attention from the evidence to the system itself. The final design keeps the triage experience focused on analyst judgment, while the audit log exposes the orchestration history only when verification or compliance requires it. One flagship case currently demonstrates the full evidence chain; the remaining cases use summarized audit entries.
Separate Patterns From Permission
Judgment-based patterns never graduate to full autonomy, regardless of approval history. Early concepts treated repeated approvals as a signal that Solace could eventually act without confirmation, similar to how routine patterns earn reduced interruption. That approach blurred the difference between recognizing a repeatable event and learning to bypass human judgment. A backup script following the same behavior is a pattern; an analyst repeatedly making the same call is still an intentional decision. Consistent approval builds confidence in the recommendation, not permission to remove the analyst from the loop.
Designing AI Behaviors, Not Just Interfaces.
Five principles designed into Solace's behavior.
Failure Visibility
When Solace doesn't have enough to go on, it says so: “no precedent found," "agents disagree," “previously overridden," instead of forcing a confident-sounding answer that would be wrong in a way she can't see coming.
Human Oversight
Actions are named, not yes or no: “Approve: isolate 2 hosts," not “Approve." A generic button gets rubber-stamped under pressure; a named one makes her read what she's actually authorizing.
Calibrated Confidence
Every score ships with the specific gap driving it. “92% confident, the missing piece is whether j.martin had legitimate reason to access LSASS," not “92%" alone, because a bare number tells her to trust it, not what to go check first.
Controllability, Break-glass
Break-glass suspends all of Solace's autonomous action outright. It has to be that blunt, because the moment something's actually gone wrong isn't the moment to be parsing which specific automations are still safe to leave running.
Controllability, Focus mode
Focus Mode is a separate, lighter control. It just quiets notifications, kept deliberately apart from break-glass so a busy shift never gets treated the same as a compromised one.
Transparency
Evidence collapses to conclusions by default, expandable into a "why this matters" row when an analyst needs to check the reasoning. Never a full-screen modal, because a wall of text under time pressure gets skipped, not read.
Scale, without the shortcuts.
Solace correlates, enriches, scores and drafts the narrative. Then stages what it recommends. It never executes anything irreversible on its own. That boundary is what makes silencing 92% of a shift's signal defensible instead of reckless, the system can afford to be aggressive about what it filters precisely because it's never the one deciding what happens next on anything that can't be undone.
What makes Solace trustworthy is knowing which decisions aren’t its to make.
Every security vendor is adding some version of an AI agent. Correlating signals, gathering context, and creating recommendations are becoming expected capabilities. What separates a system an analyst trusts from one she quietly works around is whether it understands the difference between a decision it can support and one that still belongs to her.
That’s what Maya is really trusting when she trusts Solace. Not that it will always have the answer, but that it knows when to act, when to wait for sign-off, and when to stop because the evidence isn’t strong enough. Trust is built through those boundaries: knowing when to move forward, and knowing when the human decision matters more.