Layer 04 · ACT · four-layer stack
Perception and reasoning earn their keep only when they produce accountable outcomes. Layer 04 turns the swarm's verdicts into actions for customers and regulators — in the Netherlands, under NIS2-grade expectations. Every action is proposed by an agent, gated by a human, and logged end-to-end.
Detections carry type, severity, confidence and status; the pipeline moves them from new to triaged with a full audit trail. Confidence is a number with a history, not a vibe.
Agents propose actions (block, notify, escalate). Nothing executes without a human approval — approvals, rejections and executions are all logged with timestamps.
Public-source intelligence deepens the picture around a verdict — entities, domains, exposure. Sourced, dated and cited, so the customer can re-verify every claim.
Because every layer logs, a final report isn't assembled after the fact — it is the concatenation of the trail: sensor events, agent correlations, reasoning verdicts, human approvals. That is what NIS2 actually asks for.
Correlated entity intelligence on fraud infrastructure — domains, identities, attack patterns — with evidence attached to every claim.
Dutch organisations under NIS2 need demonstrable process. Continuous detection plus an immutable trail is the posture auditors want to see.
Live, verifiable telemetry (1M+ honeypot events) and an open reasoning architecture — the platform documents itself.