The Problem Is Agents Acting Like Analysts
InfoQ reported on September 6, 2026 that Figma is using AI agents inside security workflows, including alert investigation, historical search, system checks, and draft code fixes. That is a meaningful shift because the agent is no longer just summarizing a ticket.
Security teams now need to decide what an agent may read, infer, draft, change, close, or escalate. Without an authority matrix, a useful triage assistant can quietly become an unclear decision-maker.
Why Security Agents Blur Authority
Alert triage touches identity data, endpoint records, cloud logs, source code, chat history, vulnerability context, and incident memory. A single prompt may lead the agent through systems that would normally require several human judgment calls.
The authority problem grows when memory is added. If an agent remembers prior incidents or writes durable notes, the team must decide which memories are evidence, which are working hypotheses, and which should expire after the case ends.
The Cost Of Ambiguous Triage
Ambiguous triage can create false closure, alert fatigue, unnecessary pages, hidden data exposure, and code changes that receive less review because they look routine. The value of automation is lost when analysts spend their time questioning what the agent did.
A practical cost measure is monthly alerts times agent touchpoints times disputed rate times review minutes. If 600 alerts create two agent touchpoints each, and 8 percent need ten minutes of review, the team spends 960 minutes checking uncertainty instead of reducing it.
How To Diagnose The Authority Gap
List every tool the agent can use and classify each action as read, explain, draft, change, close, or escalate. Then identify whether the action touches customer data, employee data, production systems, source code, security controls, or external communications.
The next test is reversibility. A draft pull request is easier to supervise than an automatic account lock, and a query against a security data lake is different from a persistent change to detection logic.
Options For Security Automation
The lowest-risk option is a retrieval assistant that summarizes alerts and prior incidents. The next step is read-heavy triage, followed by draft recommendations, draft pull requests, limited auto-downgrades, and tightly scoped auto-closure.
Maturity should decide the level. Teams with weak logging, unclear ownership, and sparse post-incident review should not skip directly to autonomous remediation, even when the agent appears technically capable.
Build The Triage Authority Matrix
The matrix should have rows for alert types and columns for data sources, allowed tools, maximum action, required evidence, human approver, memory target, rollback path, and logging requirement. Keep the matrix close to the detection catalog so it changes with the alert surface.
Separate prompt guidance from deterministic controls. Figma's internal-systems write-up is useful here because it describes bounded tools, scoped access, and post-step controls such as keeping generated pull requests in draft by default.
A Worked Example
For an impossible-travel identity alert, the agent may read login history, device posture, employee role, prior similar alerts, and known maintenance windows. It may write a case summary and recommend whether the analyst should downgrade, escalate, or ask for user confirmation.
The same agent should not disable the account, message the employee from an unmanaged channel, or close the alert without evidence unless the matrix explicitly allows that action. The point is not to slow triage; it is to make delegated authority visible.
Measures That Prove Control
Useful measures include alert time-to-resolution, on-call page volume, disputed agent findings, reversed auto-downgrades, draft pull request merge rate, memory corrections, and human override rate. These measures should be reviewed by the same leaders who own detection quality.
Also track policy regressions. If a new connector, model, prompt, or memory store expands access beyond the matrix, the change should be caught before the agent handles production alerts.
The Next Step This Week
Choose the ten alert types that consume the most analyst time and assign a maximum agent authority level to each one. Start with what the agent may read, what it may draft, and what it may never do without a named approver.
Then run a tabletop exercise with one real closed incident. Replay the alert and ask whether the matrix would have produced better evidence, faster escalation, or a dangerous shortcut.
Sources And Methodology
This article was triggered by InfoQ's September 6 report on Figma security agents. It also uses Figma's posts on securing internal systems with agents and staying ahead of vulnerabilities with agents.
The matrix is SynHy original analysis informed by Wiz's GhostApproval trust-boundary research and the OWASP Top 10 for LLM Applications. It should be adapted to each organization's tooling, data retention duties, and incident-response model.