Questions worth testing carefully.

RESEARCH · Personal lab evidence

AI in the SOC: validating outputs before automation

This experiment evaluates a deterministic output boundary for an AI-assisted SOC workflow using eight handcrafted response fixtures. The validator enforces exact fields, source-alert binding, strict types, and a minimum priority. Six fixtures are rejected and two are accepted as advisory text. One accepted response contains a malicious instruction in its explanation, demonstrating that schema validity does not imply semantic trust. No model is queried and no action executor is present. The experiment tests application policy behavior, not prompt-injection resistance or model accuracy.