Platform overview Remediate AI
Remediation · AI governance
Responses chosen under signed policy, applied only with approval.
Remediate AI chooses actions under signed, versioned decision policies, with playbooks and an action engine behind the human approval gate.
What it does
Remediate AI turns a case into a proposal: the action, its risk, the reasoning and the alternatives. It chooses under a decision policy that is signed with ML-DSA-65, versioned and bound to its workspace.
A person approves or rejects in the Approvals Inbox. Approved actions run through the action engine, and every result says whether the action was really applied — with undo where undo is real, and evidence kept for work people do by hand.
Policies learn under signature. A new version must pass offline evaluation on judged cases, a shadow period, a robustness range and drift checks before it is promoted, and promotion changes only what is proposed — never what may run without approval.
Key capabilities
Signed decision policies
Signed with ML-DSA-65, versioned and bound to their workspace.
Proposals with reasoning
Each proposal carries the risk, the AI’s reasoning and the alternatives.
Approvals Inbox
Every pending human decision in one queue, review-capacity aware.
Two-person rule and kill switch
Two approvers configurable per action type; a kill switch stops automated proposals.
Honest action results
Every result says whether it was really applied; undo where real.
Champion / challenger
Candidate policies compared in shadow; drift checks roll a policy back automatically.
How it works
01
Propose
A case becomes a proposal under the current signed policy.
02
Review
A person — two for critical cases — approves or rejects in the Approvals Inbox.
03
Act
The action engine runs approved actions and reports whether they were really applied.
04
Learn
Verdicts are recorded; new policy versions are evaluated before promotion.
The human approval gate
Nothing that changes a real system — block, isolate, revoke, rotate — runs without a person’s approval. The two-person rule is configurable per action type, the most critical cases always need two approvers, and a kill switch stops automated proposals.
Licence
- Included in
- Autonomous SOC licence (BlueTeam AI, Coordinator AI and Remediate AI together), Platform, Sovereign
- Licence feature
- module.blueteam_xdr
BlueTeam AI, Coordinator AI and Remediate AI are licensed together as the Autonomous SOC. Every licence includes the Core.
See pricing and licencesWhere it stands today
Containment actions (block IP, isolate host, …) are built behind the approval gate. They report “not applied” until a firewall, EDR or identity-provider connector is configured.
See the approval gate on your own scenarios.
Proposals, approvals, honest results and the audit trail, end to end.