managed security service providers

Abstract: Security operations centers are beginning to delegate detection, triage, and containment to Autonomous Cyber Defense (ACD) agents at execution time. Erroneous high-impact playbooks can disrupt critical services and create accountability gaps among deployers, SOC supervisors, vendors, managed service providers, and infrastructure providers. We propose SecODD, an execution-time governance framework for ACD that adapts the Operational Design Domain concept from autonomous-vehicle regulation to cyber autonomy. It defines the authorized scope of automated defensive actions, models when meaningful human intervention must remain possible, and specifies auditable due-care conditions through a Mitigation Safe Harbor. Four engineering requirements---tamper-evident logging, human-in-the-loop orchestration, rollback playbooks, and safe-state transition controls---are evaluated through a per-scenario audit matrix that illustrates how two ACD failure modes can be translated into pass/fail audit outcomes. The result is an evidence-oriented framework that authorizes ACD only when autonomous actions are bounded, interruptible, recoverable, and reconstructable from evidence.