SecOpent authorized pentest flow

Catalog scope → agent proposes → human decides → sign and publish

SecOpent authorized pentest flow Catalog scope → agent proposes → human decides → sign and publish open workbench with credentials scope: in · out · pre-approved techniques case state → propose next action proposal: technique · target · payload approve · dispatch within scope evidence · provenance · N/N oracle sign finding (op · tool · ts) publish signed finding to catalog Operator · human · on the record · Sequence participant Operator human · on the record Catalog · scope · approvals · Sequence participant Catalog scope · approvals Agent · LLM · proposes only · Sequence participant Agent LLM · proposes only Sandbox · seccomp · oracle · Sequence participant Sandbox seccomp · oracle Findings store · signed · immutable · Sequence participant Findings store signed · immutable Legend request return

Scope

  • • Operator opens workbench with credentials
  • • Catalog returns in-scope / out-of-scope / pre-approved techniques

Propose

  • • Agent suggests next technique + target + payload
  • • Never executes autonomously — every move is a proposal

Sign & publish

  • • Operator approves; sandbox runs deterministically with provenance
  • • Finding cryptographically signed and published to catalog + pipeline