Finding problems is the easy part; closing them is where security work stalls. Guardian is where autobotAI tracks every piece of work to closure: what was found, who owns it, what the agents did, what is waiting for a person, and which risks were accepted instead of fixed.
Guardian has these views:
| View | What it shows |
|---|---|
| Overview | Open work, waits for people, SLA breaches, risk acceptances and trends for the last 7, 30 or 90 days |
| Tasks | The task register: every unit of work agents perform |
| Harnesses | The harnesses running in your workspace, and how tasks move through them |
| Risk register | Accepted-risk exceptions, with owner, approver and expiry |
| Workloads coverage | The applications Guardian watches, and the agents assigned to each |
| Verified domains | Domains you have proved you own, which offensive scans may target |
| Dashboards | Your own metric views |
Tasks
The task register holds every unit of work agents perform, for security triage and operations alike. Each task records the finding, its severity, the domain (AppSec, SOC, GRC or identity), the resolved owner, the entities involved, milestones and the final outcome.
Task statuses
| Status | Meaning |
|---|---|
| New | Just created from a finding or event |
| Triaged | Checked, deduplicated and prioritized |
| Notified | The owner has been told |
| In progress | An agent or a person is working it |
| Escalated L1, L2, management | The SLA was missed and the task moved up the escalation chain |
| Blocked | Waiting on something outside the agent's reach |
| Resolved | Fixed and closed |
| Risk accepted | Not fixed, with an entry in the risk register |
| Suppressed | Closed as noise or a duplicate |
Resolved, risk accepted and suppressed are final. Open tasks show their SLA deadline, and tasks that have breached it or will within 24 hours are highlighted.
Severity comes from the source tool (critical, high, medium, low or informational) and is kept as reported, so you can compare it with the tool's own view.
Harnesses
The Harnesses view shows the harnesses running in your workspace, the agents in each one, and the journey of each task through them, including tool calls waiting for approval. If you haven't built a harness yet, it shows a sample story so you can see how one works. Ask Optimus to build one; see Build with AI Builder and Optimus.
Workloads
A workload is an application or service that findings are recorded under, so work rolls up to the system and team that owns it. Workloads coverage lists each one with its open and total tasks and the agents assigned to it:
- a pentest agent that tests it,
- a resolver agent, with its listener, that works new tasks toward a fix,
- a watcher agent that sweeps for work that has stalled.
When a new task arrives for a workload that has a resolver, the resolver is dispatched for that task automatically. A workload without a resolver still collects findings, but nothing works them until you attach one.
Risk register
Not every finding should be fixed now. When a team decides to accept a risk, the decision belongs on record, not in a chat thread. Each entry in the risk register carries:
| Field | Purpose |
|---|---|
| Linked task | The finding the exception covers |
| Owner | Who is accountable for the risk |
| Approver | Who signed off on accepting it |
| Justification | Why it is accepted rather than fixed |
| Compensating controls | What reduces the risk in the meantime (optional) |
| Accepted and expiry dates | When it was accepted and when the acceptance ends |
| Review cadence | How often it is re-checked |
| History | Every change, with who made it and when |
Entries are Active, Expired, Remediated or Escalated. Guardian re-evaluates each entry against its expiry, so acceptances don't lapse silently. The view also shows active and critical acceptances, and those expiring within 30 days.
Verified domains
Before an offensive scan can target a domain, you prove you own it:
- Go to Guardian > Verified domains and add the domain.
- Publish the TXT record autobotAI gives you in the domain's DNS.
- Choose Verify. If the record isn't found yet, wait for DNS to update and try again.
Only verified domains can be selected as scan targets, so a scan can never point at infrastructure you haven't shown you own.
Offensive security scans
The Offensive Security Agent runs an authorized penetration test or red-team engagement against targets you select, then produces a report you can download. Start it from Optimus.
| Setting | What you choose |
|---|---|
| Model | The AI provider, integration account and model the scan uses |
| Targets | Verified domains, repositories from a GitHub, GitLab or Bitbucket integration, and internal targets by URL or IP |
| Instructions | Optional guidance and files, such as scope notes or test accounts |
| Findings destination | The workload that records every finding as a task. You can create one from the scan |
If the workload has a resolver, findings move straight into the fix-and-verify loop. If it doesn't, they are recorded and wait until you attach one.
Run offensive scans only against systems you are authorized to test, and agree test windows with the system owners.