WHEN AI CAN ACT, WHO HAS THE AUTHORITY TO STOP IT?

 From Cybersecurity Doctrine to Enforceable Security Architecture

SYDECO Cybersecurity Newsletter — October 2026, Issue 2

Patrick Houyoux — President, PT SYDECO

 

From principle to implementation

In our first October newsletter, we examined a fundamental principle: artificial intelligence can assist human decisions, improve analysis and accelerate complex processes, but responsibility must remain clearly attributable to human authority.

That principle is important. Yet stating it is not sufficient.

The real challenge begins when we attempt to translate it into an operational cybersecurity architecture.

An organization may declare that humans remain in control of artificial intelligence. But what does that mean when an AI-assisted system detects suspicious activity, recommends intervention, or is connected to mechanisms capable of interrupting a process or isolating a machine?

 

Who authorizes the intervention? Who verifies that the authorization is legitimate? Who can reverse the action? And who remains accountable if the system makes a mistake?

 

These are not merely philosophical questions.

They are engineering questions.

Detection is not authority

Modern cybersecurity systems can collect enormous quantities of information, correlate events, detect anomalies and identify potential threats far faster than a human analyst.

Artificial intelligence can contribute significantly to this work.

But detecting a potential threat does not automatically justify taking disruptive action.

A suspicious process is not necessarily a malicious process. An unusual network connection is not necessarily an attack. An anomaly score is not a legal or operational authorization.

Confusing detection with authority creates a dangerous situation: technology may begin making consequential decisions without the necessary institutional controls.

 

At SYDECO, we believe that cybersecurity architecture must distinguish four essential functions:

Detection: What is happening?

Analysis: What does the available evidence suggest?

Authorization: Who is entitled to approve an intervention?

Controlled response: What action may be executed, under which conditions, and with what possibility of verification or reversal?

These functions may operate within one integrated system, but they must not lose their distinct responsibilities.

 

Human control must exist inside the architecture

 

Human oversight is sometimes presented as a simple requirement for an operator to click an approval button.

That is not enough.

A credible security architecture must verify the identity and authority of the person approving an action.

 

It must prevent unauthorized escalation, distinguish observation from intervention and maintain records of decisions and their execution.

For particularly sensitive actions, separation of duties may be necessary: one person proposes the intervention, while another independently authorizes it.

The system must also recognize uncertainty.

 

If an AI component cannot provide a reliable assessment, it should not manufacture confidence or silently substitute another decision mechanism.

Equally important, a security system must be capable of explaining what action was requested, what was authorized, what actually happened and whether the intended technical result was achieved.

 

Human Oversight: An Internationally Recognized Security Principle

 

This principle is not confined to SYDECO's own cybersecurity doctrine.

 

In the United States, the National Institute of Standards and Technology (NIST), through its Artificial Intelligence Risk Management Framework, emphasizes the importance of defining human responsibilities, establishing oversight mechanisms and ensuring accountability throughout the AI system lifecycle.

 

Its approach recognizes that the appropriate degree of human intervention depends on the nature and risks of the decisions involved.

 

This distinction is fundamental.

 

Not every automated security operation requires individual human approval. Routine monitoring, data collection and preliminary analysis can operate automatically within predefined policies.

 

However, when a system is capable of taking actions that may disrupt operations, affect availability or produce significant consequences, the question of authorization becomes critical.

 

The issue is therefore not whether artificial intelligence should operate autonomously.

 

The issue is who defines the limits of that autonomy, who authorizes consequential interventions, and how those limits are technically enforced.

 

This international perspective reinforces SYDECO's conviction that effective cybersecurity is not simply about developing increasingly intelligent systems.

It is about developing systems whose intelligence operates within a clearly defined framework of human authority and organizational accountability.

 

Accountability cannot be added afterward as a reporting feature. It must be designed into the system itself.

Sovereignty is also an architectural decision

 

There is another dimension to this discussion: the location and control of the analysis.

Increasingly, organizations send operational information to external services for interpretation.

Depending on the information concerned, that practice may introduce questions about confidentiality, jurisdiction, data exposure and dependence on external infrastructure.

 

Cloud processing is not inherently insecure. However, organizations dealing with sensitive information should have the ability to decide where their data is processed and who controls the infrastructure.

 

Local AI processing can help maintain that control.

It allows security analysis to be performed within the organization's defined infrastructure, reducing the need to transmit sensitive telemetry to external AI providers.

 

For SYDECO, digital sovereignty is not simply a matter of national preference.

It is a question of enforceable technical control.

 

From doctrine to engineering: RISKIPSO

 

For more than a decade, SYDECO has developed cybersecurity technologies around the principles of prevention, visibility, controlled access and protection of information systems.

 

Our current RISKIPSO development extends this philosophy into AI-assisted security operations.

 

RISKIPSO is being engineered to connect security detection and analysis with explicitly controlled response mechanisms.

 

Its local AI analysis uses SYDECO LightML, avoiding reliance on external AI services for the verified analysis pipeline.

 

Within the currently validated implementation, AI provides advisory analysis. It does not independently acquire authority to execute disruptive actions.

 

Selected response operations are protected by a two-person authorization mechanism, and execution events are recorded with technical audit evidence.

 

These are engineering mechanisms already tested in the development environment. Further integration and operational qualification are continuing before commercial release.

 

The purpose of mentioning RISKIPSO is not to present another artificial intelligence product as a universal solution. It is to demonstrate that the principles we defend can be translated into technical mechanisms.

Detection can be automated.

Analysis can be accelerated.

But authorization must remain subject to enforceable rules, and execution must remain accountable.

 

The question every organization should ask

The most important question is not whether an organization uses artificial intelligence.

Nor is it whether the system is sufficiently autonomous.

The question is whether its authority is defined, technically restricted and auditable.

Can the organization determine what the system may observe?

Can it restrict what the system may recommend or execute?

Can it identify who authorized a consequential action?

Can it verify the result?

And can it intervene when something goes wrong?

If these questions cannot be answered, the organization may possess sophisticated technology without possessing effective control over it.

 

Our conclusion

 

Artificial intelligence will continue to transform cybersecurity. It will make detection faster, analysis more sophisticated and security operations potentially more effective.

But speed is not authority.

Intelligence is not accountability.

And automation is not governance.

 

At SYDECO, our conviction remains unchanged:

The purpose of cybersecurity technology is not to replace human responsibility. It is to strengthen the ability of responsible people to protect the systems entrusted to them.

 

A security system should never possess more authority than the organization has deliberately granted to it.

 

That is the difference between merely deploying artificial intelligence and designing a security architecture that deserves trust.

 

Patrick Houyoux
President — PT SYDECO
Yogyakarta, Indonesia

Cybersecurity by Design. Sovereignty by Architecture. Human Authority by Principle.

 

#Cybersecurity #AIGovernance #HumanOversight #DigitalSovereignty #SOC #SOAR #RISKIPSO #SYDECO