Automation DSL

name: suspicious-login-response
trigger:
  event: identity.login.risky
conditions:
  all:
    - {fact: risk.score, op: gt, value: 70}
    - {fact: device.trusted, op: eq, value: false}
steps:
  - action: verify.step_up
  - brain: security_investigator
  - if: {fact: risk.score, op: gt, value: 90}
    then:
      - action: security.revoke_sessions
      - action: security.isolate_device   # high risk → approval
  - action: incident.create
  - action: notify.role
    with: {roles: [security_analyst]}

Every run records per-step evidence; high-risk actions pause for approval according to the automation.approve policy; dry-run replays historical events.