You will frame a safe first version of PhishTriage-v1 for BrightShield Credit Union. A security orchestration, automation, and response (SOAR) playbook connects alert data, enrichment, routing, and approved actions into a repeatable workflow. A large language model (LLM) step reads defined text and returns structured advisory output, such as a summary or suggested tags. It can help an engineer make a playbook easier to operate without receiving authority to contain an incident.
At BrightShield, the useful boundary is clear. The LLM can enrich a phishing alert, draft a concise explanation, and support notification. An analyst remains accountable for the disposition and must approve quarantine, blocking, or account changes.
The playbook begins with an inbound email alert and ends with recorded, reviewable actions. Untrusted email content can reach an LLM enrichment step only after the workflow removes data outside its approved scope. The LLM returns a fixed JSON schema that the playbook validates before writing to the ticket. It has no direct access to quarantine controls, block lists, credentials, or downstream permissions.
This design treats the LLM as an enrichment and classification node rather than a decision maker. The analyst gate separates advisory text from any action that could disrupt a member, employee, or business process. Let’s trace where trust changes across PhishTriage-v1:
Email bodies, ticket text, and extracted headers are attacker-controlled input. Indirect prompt injection is an instruction hidden in content the LLM reads, intended to redirect its behavior or expose data. A hallucinated indicator is an invented domain, address, or other security detail that lacks support in the underlying record. Both risks matter because a polished summary can appear actionable while being unsafe or unsupported.
BrightShield limits BeaconLLM to Internal security-event text and requires traceable source record IDs. The workflow should pass only the minimum text needed for enrichment. A model that reads untrusted content must hold no tools, secrets, or containment permissions. Let’s examine the operating rules that set this boundary: