The Irreversibility Spectrum: A Taxonomy of Autonomous SOC Actions

Every automated action a security system takes has a reversal cost. Closing a firewall rule is not symmetric with opening it: the former takes a second, the latter may require a change-management ticket, a maintenance window, a coordination call, and a post-change verification. Alert generation is nearly free to undo. A host quarantine that takes five production services offline may take two engineering teams most of a business day to remediate. This asymmetry between execution and reversal is the central governance challenge for autonomous SOC platforms: the same automation that makes response fast makes errors expensive. This article builds the Irreversibility Spectrum — a formal taxonomy of autonomous SOC actions organized by the cost and speed of their reversal — as the foundational artifact for reasoning about when autonomous execution is safe and when it is not.

Why Reversibility Is a Safety Property

The principle that AI systems should be designed to be safely correctable is well established in the AI safety literature. Hadfield-Menell et al. (2017) formalized this through the Off-Switch Game, demonstrating that an AI agent optimizing a utility function should, under uncertainty about that function, prefer to preserve human override capability rather than resist it. Applied to the autonomous SOC context, this principle yields a direct architectural requirement: the response actions an autonomous system may take should be bounded by the reversibility of those actions, because reversibility is the mechanism through which human oversight reasserts control after an incorrect automated decision.

NIST AI 100-1 (2023) operationalizes this principle through its Govern function, which requires that AI systems in high-stakes contexts be designed with explicit mechanisms for human override, error correction, and safe shutdown. For an autonomous SOC response engine, 'safe shutdown' is not stopping the engine — it is reversing the engine's prior actions. A system whose actions cannot be reversed is, in AI safety terms, a system that cannot be corrected after deployment, which is precisely the failure mode the Govern function is designed to prevent.

NIST SP 800-61 Rev. 2 (2012) identifies containment, eradication, and recovery as the three phases following detection. It distinguishes between temporary containment strategies — designed to be reversed once the threat is resolved — and permanent eradication steps. An autonomous SOC that conflates these, executing permanent eradication actions in the containment phase when threat characterization is still incomplete, violates this operational discipline regardless of detection model accuracy.

Cummings (2014) surveys the supervised automation spectrum and argues that the appropriate level of automation depends on time constraints, cognitive load, error consequences, and reversibility. Tasks with low error consequences and fast reversibility can be safely automated; tasks with high consequences and slow reversibility require human involvement regardless of machine accuracy. The Irreversibility Spectrum applies this principle to SOC response actions specifically.

Defining the Irreversibility Spectrum

The Irreversibility Spectrum is a two-dimensional classification space for autonomous SOC response actions. The first dimension is reversibility time — the expected elapsed time from the decision to undo an action to the moment its effects are fully cancelled, capturing both technical complexity of reversal and organizational complexity. The second dimension is blast radius — the number of assets, users, services, or network paths materially affected during the period between action execution and its potential reversal.

Together, these dimensions define the Irreversibility Score of an action: the product of reversibility time and blast radius represents the expected operational impact of an erroneous execution. An action with a five-minute reversibility time and a blast radius of one host has a much lower Irreversibility Score than one with a four-hour reversibility time affecting fifty production services.

The Spectrum spans from its low end — actions nearly free to reverse affecting at most a single alert — to its high end — actions requiring days to reverse, if reversible at all, affecting critical infrastructure availability. Eight action classes map to distinct regions of this Spectrum. The governance implication is straightforward: the Irreversibility Spectrum defines an autonomous authority budget — the subset of the Spectrum where autonomous execution is acceptable given the organization's risk tolerance — and any action falling outside that budget requires human confirmation before execution.

Eight Action Classes: A Taxonomy

The taxonomy identifies eight action classes spanning the Irreversibility Spectrum. Alert Generation and Enrichment occupies the lowest end. The action produces no changes to any protected asset; reversal is dismissing the alert. Blast radius is one alert record. Full autonomous execution is appropriate.

Rate Limiting throttles traffic from or to a specific source. Reversal restores the original traffic policy in seconds. Blast radius is the affected source and accessed resources. Autonomous execution is appropriate with controls on the rate of rate-limiting decisions.

Soft Isolation removes a host from a network segment while maintaining forensic and management traffic. Reversal reconnects the host in minutes. Semi-autonomous execution with automatic reversal after a configurable timeout is appropriate.

Host Quarantine fully isolates a host from all production network traffic. Reversal requires restoring all network policies and verifying service restoration — typically thirty minutes to several hours depending on the host's role. Blast radius extends to every dependent service. Human confirmation is required before execution.

Credential Suspension disables a user or service account. Reversal requires restoring the account, resetting dependent services, and verifying dependent applications, which can take hours in environments with many credential dependencies. Human confirmation is required.

Policy Modification changes firewall rules, network access control lists, or security group policies. Reversal requires identifying and systematically reversing all changes, complicated by policy interdependencies. Human confirmation with change-management review is required.

Evidence Modification — any action that modifies or deletes forensic artifacts, logs, or audit records — sits at the extreme high end of the Spectrum. ISO/IEC 27035-1:2023 requires that incident evidence be preserved and its integrity maintained throughout investigation and any legal proceedings. This class is categorically prohibited from autonomous execution.

Formalizing the Reversibility Dimensions

The reversibility time dimension requires precise definition to be operational. Let T_execute(a) be the time required to execute action a, and T_reverse(a) be the expected time required to fully cancel the effects of a from the moment the reversal decision is made to the moment all affected assets are restored to their prior state. The asymmetry ratio R(a) = T_reverse(a) / T_execute(a) measures how much slower reversal is than execution. For alert generation, R approaches 1. For credential suspension in an enterprise environment with many dependent services, R may exceed 500.

The blast radius dimension B(a) is defined as the number of distinct assets, users, or network paths whose availability or integrity is affected during the period T_reverse(a) after erroneous execution. A host quarantine taking two hours to reverse affecting twenty dependent services has B = 20 for a two-hour window. A rate limit taking five seconds to reverse affecting one client connection has B = 1 for a five-second window.

The Irreversibility Score S(a) = T_reverse(a) × B(a) yields an operational measure of total impact exposure created by an erroneous autonomous execution, measured in asset-minutes. Seshia et al. (2018) argue for formal specification of the operating envelope of AI systems — the set of conditions under which the system's behavior meets its design requirements. The Irreversibility Score threshold τ_max — the maximum S permitted for autonomous execution — is one component of the autonomous SOC's operating envelope.

Deriving τ_max from organizational risk tolerance rather than from the capabilities of the detection engine is the key governance insight the Spectrum formalizes.

The Authority-Reversibility Principle

The taxonomy and Irreversibility Score support a governance rule that can be stated simply: autonomous authority should be inversely proportional to action irreversibility. The higher the Irreversibility Score of an action, the more human oversight is required before execution. This rule — the Authority-Reversibility Principle — follows from the NIST AI RMF's requirement that AI systems in consequential contexts preserve human override capability, and from incident response discipline's requirement that containment actions be reversible until the threat is confirmed.

The principle has a practical corollary that is often violated in current autonomous SOC deployments. Many organizations configure autonomous response to execute the highest-confidence, highest-severity responses fully autonomously — precisely because high-severity incidents appear to demand machine-speed action. But high severity correlates with high blast radius and often with slow reversibility: a high-severity incident typically involves a critical production host or privileged account, both of which have large blast radii and slow reversal procedures. The Authority-Reversibility Principle inverts this: the actions most likely to be triggered by a high-severity alert require the most human oversight, because they are the most costly to reverse if the alert is wrong.

NIST SP 800-207 (2020) identifies microsegmentation and just-in-time access as preferred Zero Trust responses to a confirmed threat, precisely because these mechanisms have lower blast radii and faster reversibility than network blocks or broad credential revocations. The Authority-Reversibility Principle provides the theoretical underpinning for this preference. Cummings (2014) identifies consequence asymmetry as a critical variable for automation design decisions; the Irreversibility Score makes that asymmetry quantifiable for SOC automation.

Mapping Standard SOC Actions to the Spectrum

NIST SP 800-61 Rev. 2 (2012) defines four containment strategies: evidence gathering, short-term containment, system backup, and long-term containment. Evidence gathering — capturing network traffic, memory dumps, log snapshots — is a low-blast, low-reversibility-impact action and is appropriate for autonomous execution subject to storage and privacy controls. Short-term containment maps to soft isolation or host quarantine depending on implementation, placing it in the semi-autonomous or human-confirm zone. Long-term containment, including rebuilding or reimaging affected systems, is a high-blast, slow-reversibility action that should never execute autonomously.

NIST SP 800-53 Rev. 5 (2020) defines the Incident Response control family (IR-1 through IR-10), which includes automated response as an enhancement. The control language requires that automated response be consistent with the organization's incident handling capability — a phrase the Irreversibility Spectrum operationalizes. Automated response is consistent with the organization's capability when it operates within the authority budget defined by τ_max; it exceeds that capability when it executes actions above the Spectrum threshold.

Casey (2011) identifies the forensic soundness principle — the requirement that investigative actions minimize changes to the original evidence — as a foundational constraint on all incident response activities. Forensic soundness maps directly to the low end of the Irreversibility Spectrum: autonomous actions that might alter forensic artifacts should be either completely non-destructive or require human confirmation.

Setting the Authority Budget

The authority budget τ_max is the practical implementation of the Authority-Reversibility Principle. Setting τ_max requires balancing two organizational objectives: maximizing autonomous response speed and minimizing potential operational cost of an erroneous autonomous action. The balance depends on three inputs: the mean time to identify a false positive (MTTIFP), the acceptable operational impact of an erroneous autonomous action expressed in asset-minutes, and the availability of human confirmation within a defined latency.

A practical heuristic for initial τ_max setting is τ_max = MTTIFP × B_max, where B_max is the maximum acceptable blast radius for an erroneous autonomous action. If the SOC's MTTIFP is fifteen minutes and the threshold for autonomous blast radius is two hosts, then τ_max = 30 asset-minutes. Actions with Irreversibility Scores above 30 require human confirmation. This heuristic provides an organization-specific anchor to be refined against actual false-positive rates and operational costs during a pilot period.

The authority budget should be tiered rather than binary. OWASP Agentic Security Initiative (2025) recommends graduated control levels for AI agents: fully autonomous, supervised with automatic override, human-in-the-loop, and prohibited. The Irreversibility Spectrum supports this tiering: actions with S below τ_max/3 are fully autonomous; those between τ_max/3 and τ_max are supervised with automatic reversal triggers; those between τ_max and 3τ_max require human confirmation; those above 3τ_max or in the Evidence Modification class are prohibited.

Limitations

The Irreversibility Score S = T_reverse × B is a product of two measurements that are difficult to assess precisely in advance. T_reverse is highly context-dependent: the time to restore a quarantined database server depends on which services depend on it, the state of current traffic, the expertise of the on-call team, and whether the quarantine triggered cascade failures. B is similarly context-dependent. Organizations should treat Irreversibility Scores as order-of-magnitude estimates and maintain empirical logs of actual reversal times to calibrate τ_max settings.

The taxonomy presented here maps to the current state of autonomous SOC capabilities. As agentic systems begin executing multi-step response playbooks across multiple tools, new action classes will emerge whose Irreversibility Scores may not fit neatly into the eight classes defined here. The framework should be treated as extensible: any new action class should be assessed for reversibility time and blast radius before authorization.

The Authority-Reversibility Principle assumes that human confirmation adds value — that human responders have sufficient context to make better decisions than the autonomous system and sufficient time to review before the action's window closes. Both conditions may fail under peak incident load. Organizations should plan for this failure mode by pre-authorizing specific high-Irreversibility actions for autonomous execution in narrowly defined emergency conditions, documented as exceptions in the governance charter and subject to post-incident review.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# Authority Budget Policy
MTTIFP_minutes = 15  # empirically measured, not estimated
MAX_BLAST_RADIUS = 5  # org-specific risk tolerance
tau_max = MTTIFP_minutes * MAX_BLAST_RADIUS  # e.g. 75 asset-minutes

ACTION_CATALOG = {
  'alert-generate':     {'T_reverse': 0,   'blast': 1,   'tier': 'autonomous'},
  'rate-limit-ip':      {'T_reverse': 0.1, 'blast': 1,   'tier': 'autonomous'},
  'soft-isolate-host':  {'T_reverse': 5,   'blast': 2,   'tier': 'supervised'},
  'quarantine-host':    {'T_reverse': 60,  'blast': 10,  'tier': 'human-confirm'},
  'revoke-credential':  {'T_reverse': 120, 'blast': 20,  'tier': 'human-confirm'},
  'block-network-path': {'T_reverse': 240, 'blast': 50,  'tier': 'human-confirm'},
  'modify-policy':      {'T_reverse': 480, 'blast': 100, 'tier': 'human-confirm+review'},
  'modify-evidence':    {'T_reverse': None,'blast': None,'tier': 'prohibited'},
}

function authorize_action(action_id):
  a = ACTION_CATALOG[action_id]
  if a['tier'] == 'prohibited': raise Prohibited()
  score = a['T_reverse'] * a['blast']
  if score > tau_max: require_human_confirmation(action_id)
  elif score > tau_max / 3: require_supervised_execution(action_id)
  else: execute_autonomously(action_id)

Glossary

Irreversibility Spectrum

A two-dimensional classification space for autonomous SOC response actions, organized by reversibility time and blast radius.

Irreversibility Score (S)

The product of reversibility time and blast radius for a given action class, measured in asset-minutes and used to determine the required authority level for autonomous execution.

Authority-Reversibility Principle

The governance rule that autonomous authority for a SOC response action should be inversely proportional to that action's Irreversibility Score.

Blast Radius

The number of distinct assets, users, services, or network paths whose availability or integrity is materially affected during the period between an action's execution and completion of its reversal.

Reversibility Time

The expected elapsed time from the decision to undo an autonomous SOC action to the moment its effects are fully cancelled and all affected assets are restored to their prior state.

Authority Budget (τ_max)

The maximum Irreversibility Score permitted for autonomous or supervised-autonomous execution, derived from the organization's mean time to identify a false positive.

References

1. NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide
2. NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0)
3. NIST SP 800-207: Zero Trust Architecture
4. NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems
5. ISO/IEC 27035-1:2023, Information Security Incident Management — Part 1: Principles
6. OWASP Agentic Security Initiative: Agentic AI Threats and Mitigations (2025)
7. Hadfield-Menell et al. — The Off-Switch Game (IJCAI, 2017)
8. Seshia et al. — Formal Specification for Deep Neural Networks (ATVA, 2018)
9. Casey — Handbook of Digital Forensics and Investigation (Elsevier, 2011)
10. Cummings — Man vs. Machine or Man + Machine? (IEEE Intelligent Systems, 2014)