• 

  Diagram of Agentic Architecture

Human-in-the-Loop Context for Agentic Network Security

Inspiration

Modern network security tools can detect suspicious activity, but they often cannot understand the real-world reason behind it. A connection may look dangerous because it comes from a VPN, a new location, or an unusual time, even when the employee is performing authorized work.

We wanted to give AI security agents a safe way to ask trusted people for the organizational context that network data cannot provide.

What it does

Human-in-the-Loop Context for Agentic Network Security connects a network-defense AI agent with a chat-based AI agent that can retrieve networking conversations and ask humans in order to get the necessary context to add and remove networking rules.

When a suspicious connection is blocked, the system:

• Receives the blocked network event
• Explains why the connection was blocked
• Identifies what information is missing
• Sends a structured context request to the chat agent
• Receives confirmation or denial from authorized users
• Validates the response
• Applies a limited, temporary network rule
• Automatically removes the rule when it expires

For our demo, an employee connecting through a VPN is initially blocked. A manager confirms through the group chat that the employee is traveling and performing authorized work. The system then temporarily allows only the required connection.

How we built it

We divided the system into two cooperating AI agents:

• Network Agent: Monitors blocked network activity, analyzes the event, requests additional context, validates the response, and updates the firewall.
• Chat Agent: Communicates with authorized users in a group chat and returns their response as structured evidence.

The network agent receives information such as the source IP, destination, port, time, and firewall rule that caused the block. It then sends a structured request to the chat agent.

Approved access is restricted to the original source, destination, protocol, and port. Each rule has a short expiration time and is recorded in an audit log.

Our demo workflow is:

Blocked Connection → Network Agent → Chat Agent → Authorized Human → Validated Decision → Temporary Firewall Rule

Challenges we ran into

One challenge was ensuring that human approval did not create an overly broad firewall exception. Allowing an entire IP address could unintentionally grant access to unrelated services.

We addressed this by limiting each approval to the exact connection that was originally blocked.

Another challenge was deciding what role the AI should play. We did not want an AI model to generate and execute arbitrary firewall commands. Instead, the AI analyzes the event and prepares a structured recommendation, while deterministic validation code controls the actual network change.

We also needed to prevent repeated dropped packets from creating many duplicate chat requests, so related events are grouped into a single incident.

Accomplishments that we're proud of

• Connected network security events with organizational context from trusted humans
• Built communication between two specialized AI agents
• Created a complete flow from detection to temporary enforcement
• Limited approvals to exact network connections
• Added automatic rule expiration and rollback
• Kept the AI separated from unrestricted firewall control
• Demonstrated how outside context can reduce unnecessary security blocks

What we learned

We learned that network data can explain what happened, but it cannot always explain why it happened.

Some security decisions depend on information held by managers, system owners, or incident leaders. Giving an AI agent a controlled way to request that information can improve its decisions without giving either the AI or the human unlimited control.

We also learned that AI works best in this system as a reasoning and coordination layer. Final enforcement should remain structured, validated, limited, and reversible.

What's next

Next, we plan to:

• Bind approvals to verified users and managed devices instead of only IP addresses
• Dynamically select the correct authority for each type of incident
• Support multiple scenarios beyond VPN access
• Compare technical evidence with human responses and reject contradictions
• Add multi-person approval for high-risk actions
• Integrate identity, device, ticketing, and organizational directory systems
• Measure reductions in false blocks and response time
• Continuously monitor approved activity and revoke access when behavior changes

Built With

• api
• codex
• openaiagents-sdk