veriomMulti-agent system
Fifteen specialist roles, typed artifact handoffs, activation rules, guardrails, model tiers, and architecture-impact adjudication.
Agents collaborate through validated artifacts—not hidden chain-of-thought. Every artifact records its agent definition version, model, context hash, evidence IDs, confidence, usage, latency, and decision summary.
Role registry
| Role | Primary responsibility |
|---|---|
| Audit Coordinator | scope, activation, stage and retry decisions |
| Context Curator | assemble bounded ContextPacks |
| Evidence Verifier | reject unsupported claims and contradictions |
| Security Engineer | technical vulnerabilities and control failures |
| Security Architect | boundaries, reachability, blast radius, structural weakness |
| Cloud/IaC Analyst | infrastructure entities, policy, network, identity |
| CI/CD Analyst | pipeline, artifact, deployment, and provenance relationships |
| Threat Modeler | assets, actors, paths, abuse cases, mitigations |
| Remediation Engineer | deterministic patch proposal and static rescan plan |
| Diagram Architect | safe views of the canonical graph |
| Report Synthesizer / Adjudicator | reconcile artifacts into canonical JSON |
| Finding Architecture Impact Adjudicator | determine whether scanner observations materially affect evidenced architecture |
| Compliance Control Analyst | map evidence to bounded assurance questions without certifying compliance |
| Architecture Diagnostic Analyst | identify gaps, contradictions, staleness, and unlinked signals |
| Architecture History Analyst | explain changes between comparable truth snapshots |
A deeper review requires explicit approval. An agent failure does not expand its authority.
Review boundaries
Each role has a defined evidence scope, allowed actions, and expected output. Reviews preserve source identifiers, confidence, usage, and decision history so your team can inspect a conclusion and its limits.
Human approval remains explicit for consequential actions.
Evidence adjudication
An observation becomes canonical only after the verifier can resolve every cited evidence ID in the same audit and workspace. Unsupported claims remain hypotheses. Conflicting agent artifacts are retained and sent to adjudication with the underlying evidence—not resolved by majority vote.
For scanner observations, citation validity is necessary but not sufficient. Architecture relevance requires a concrete affected entity, relationship, trust boundary, identity, pipeline, data flow, or constraint. An automatic exclusion requires scanner evidence plus independent structural evidence for a concrete exclusion. Missing deployment, cloud, runtime, or reachability evidence routes to human review.
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.