Predictika · Autonomous email-security remediation · AI agents

An AI security agent's remediation actions, checked before they run

An AI agent that remediates email threats can remove a campaign from thousands of mailboxes, end sessions, force password resets, block sign-ins and suspend or cut off other AI agents. Before each action runs, the agent sends it to Predictika, which checks it against the customer's own response policy and the state of the target, and returns a verdict (allow, needs approval or block), every reason, and the same answer on every call.

Source and independence. The kinds of action come from public descriptions of autonomous remediation, such as removing malicious messages and campaigns, ending sessions and forcing credential resets (AI-driven auto-remediation) and suspending an agent run or revoking its access (AI agent security). The tool names here are descriptive, not any vendor's API names, and the rules are example policies of a fictional customer, not any vendor's rules. The accounts, agents and campaigns are that customer's inventory, supplied by the customer's own system. No vendor is involved in this demonstration or has endorsed it.

Scope: remediation actions on accounts, AI agents and detected campaigns. See everything this validator covers

This validator handles any call to these actions against this inventory — not just the scenarios shown below.

Actions modeled — remove_message, remediate_campaign, terminate_sessions, force_password_reset, block_signin, revoke_agent_credential, suspend_agent_run and explain_to_reporter, each with the target and, for a campaign, the number of mailboxes the agent says it reaches.
Example customer policies — check that each action is aimed at the right kind of target; require a stated mailbox count that matches the campaign; block removing mail on legal hold; hold a removal larger than 500 mailboxes for a person; block any action on a detection confidence under 60 and hold one between 60 and 84; never lock a break-glass or service account; hold actions on executives, administrators, accounts with no MFA, anyone in a critical window such as quarter-close, a vendor with an open invoice, and an AI agent that production payroll depends on. These are illustrative examples; every number is the customer's to change.
Customer-supplied inventory (fictional) — 10 accounts, 3 AI agents and 7 detected campaigns, with their roles, holds, MFA status and detection confidence. Whether an approval is on file is also recorded by the customer and cannot be checked by the validator.

Not covered: the detection itself, any vendor's own controls (which remain worth using alongside), real inventory feeds, and actions not listed above.

The AI remediation agentDecides which action to take and says the action is ready to run.

Predictika validatorChecks every policy at once and returns the verdict and each finding before anything is touched.

8 scenarios in 4 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI remediation agent says

Proposing agent: AI remediation agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator

Waiting for the call.

Where a confidence threshold or allow/deny list alone gets it wrong

Click to expand

Our assessment of what a detection-confidence threshold or an allow/deny list does with the same cases. It is a general judgment about fit, not a claim about any vendor's product, and those controls remain worth using alongside the validator.

What the validator caught	Threshold or list alone	Predictika
A removal that reaches mail on legal hold, though the detection is confident	Only with workarounds A confidence threshold knows how sure the detection is, not which mailboxes are under hold.	The state of every mailbox is looked up on every call and the reason is returned.
The agent states 12 mailboxes and the campaign reaches 4,180	Only with workarounds A threshold or list never sees the count the agent expects.	The stated scope is compared with the real one.
Ending sessions aimed at an AI agent instead of suspending its run	Only with workarounds An allow or deny list says the action is permitted; it does not say it is the wrong kind for this target.	Each action is checked against the kind of target.
Hold for a person: a large removal, an executive, quarter-close	Only with workarounds A list allows or denies. Holding with the reason is a third outcome it does not give.	Allow, needs approval and block are three verdicts of the same check.
Every reason in one answer	Only with care A denial typically stops at the first refusal.	All findings come back together, whatever order the choices arrived in.

What this validator catches: findings from its test cases