Greenlight's 90% Autonomous SOC: Tiered Agent Escalation and Episodic Memory at 4,000 Cases Per Month

Greenlight Financial processes 4,000 security and risk cases per month. More than 90% resolve without human intervention. The system, called Luna, runs on Amazon Bedrock AgentCore and uses a tiered multi-agent architecture with episodic memory. This is not a proof of concept. It is production infrastructure in a regulated fintech environment handling SOC operations and financial risk triage.

The architecture exposes three core problems: routing cases to specialist agents, deciding when to escalate to humans, and learning from resolved incidents. Greenlight's solution offers a reference implementation for autonomous security operations at scale.

Tiered Agent Routing

Luna uses a three-tier agent hierarchy:

1. Orchestrator agent: Receives incoming cases, classifies intent, and routes to specialist agents.
2. Specialist agents: Domain-specific agents for SOC operations, financial risk, compliance, and fraud detection.
3. Human escalation: Cases that exceed confidence thresholds or require regulatory approval.

The orchestrator does not attempt to solve cases. It performs intent classification and selects the appropriate specialist. Each specialist agent has its own tool set, knowledge base, and escalation logic.

Routing Decision Logic

The orchestrator uses a combination of:

• Keyword extraction from case descriptions
• Confidence scoring on intent classification
• Historical routing patterns from episodic memory
• Explicit escalation rules for regulated actions

If confidence falls below a threshold (typically 0.7 to 0.8), the case routes to human review. If multiple specialists could handle the case, the orchestrator selects based on historical success rates.

This is not a single-agent system with multiple tools. Each specialist is a distinct agent with its own prompt, context window, and tool access. The orchestrator maintains no case state beyond routing metadata.

Episodic Memory for Continuous Learning

Episodic memory stores resolved cases as structured records. Each record includes:

• Case description and classification
• Specialist agent assignment
• Tool calls executed
• Resolution outcome (success, escalation, failure)
• Human feedback when available

When a new case arrives, the orchestrator queries episodic memory for similar past cases. The retrieval uses semantic similarity on case descriptions and filters by resolution outcome. Successful resolutions inform routing decisions and provide context to specialist agents.

Memory Retrieval Flow

# Simplified retrieval logic
def route_case(case_description):
    # Semantic search for similar resolved cases
    similar_cases = episodic_memory.query(
        embedding=embed(case_description),
        filters={"resolution": "success"},
        limit=5
    )

    # Extract routing patterns
    specialist_scores = {}
    for past_case in similar_cases:
        specialist = past_case["assigned_specialist"]
        similarity = past_case["similarity_score"]
        specialist_scores[specialist] = specialist_scores.get(specialist, 0) + similarity

    # Select specialist with highest aggregate score
    selected_specialist = max(specialist_scores, key=specialist_scores.get)
    confidence = specialist_scores[selected_specialist] / len(similar_cases)

    if confidence < 0.7:
        return escalate_to_human(case_description)

    return assign_to_specialist(selected_specialist, case_description, similar_cases)

The specialist agent receives both the new case and the top three similar resolved cases. This provides few-shot examples without manual prompt engineering.

State Persistence and Audit Trails

Every agent action writes to an immutable audit log. The log captures:

• Agent ID and version
• Tool calls with input parameters
• Tool responses
• Reasoning traces (when available from the LLM)
• Escalation triggers

Greenlight runs in a regulated environment. Audit trails must survive agent failures, model updates, and infrastructure changes. The log uses append-only storage with cryptographic checksums.

State persistence happens at two levels:

1. Case state: Stored in a relational database with ACID guarantees. Each state transition is a database transaction.
2. Agent context: Stored in Amazon Bedrock AgentCore's session management. Context expires after 24 hours or case resolution.

If an agent crashes mid-case, the orchestrator can resume from the last committed state. The specialist agent receives the full case history and continues execution.

Expansion from SOC to Financial Risk

Greenlight started with SOC operations (malware alerts, access violations, suspicious logins). The system now handles financial risk cases (transaction anomalies, account takeover attempts, regulatory compliance checks).

The expansion required three changes:

1. New specialist agents with domain-specific tools (transaction analysis, account history retrieval, regulatory rule engines).
2. Stricter escalation rules for financial actions. Any case involving account freezes, fund transfers, or regulatory reporting escalates to human review.
3. Separate episodic memory stores for SOC and financial risk. Cross-domain retrieval introduced false positives.

The orchestrator logic remained unchanged. Adding a new domain means deploying a new specialist agent and updating the routing rules.

Failure Modes and Mitigations

The most common failure is escalation loops. Early versions of Luna would escalate cases that looked novel, even when similar cases had been resolved. The fix was adding a similarity threshold: if no past case exceeds 0.6 similarity, route to human review instead of attempting autonomous resolution.

Architecture Diagram

┌─────────────────┐
│  Incoming Case  │
└────────┬────────┘
         │
         ▼
┌─────────────────────────────┐
│  Orchestrator Agent         │
│  - Intent classification    │
│  - Episodic memory query    │
│  - Routing decision         │
└────────┬────────────────────┘
         │
         ├──────────┬──────────┬──────────┐
         ▼          ▼          ▼          ▼
    ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
    │  SOC   │ │  Risk  │ │Compliance│ │ Fraud │
    │ Agent  │ │ Agent  │ │  Agent  │ │ Agent │
    └───┬────┘ └───┬────┘ └───┬────┘ └───┬────┘
        │          │          │          │
        └──────────┴──────────┴──────────┘
                   │
                   ▼
         ┌─────────────────────┐
         │  Tool Execution     │
         │  - API calls        │
         │  - Database queries │
         │  - Rule engines     │
         └──────────┬──────────┘
                    │
                    ▼
         ┌─────────────────────┐
         │  Audit Log          │
         │  (immutable)        │
         └─────────────────────┘
                    │
                    ▼
         ┌─────────────────────┐
         │  Episodic Memory    │
         │  (resolved cases)   │
         └─────────────────────┘

Observability and Metrics

Greenlight tracks:

• Automation rate: Percentage of cases resolved without human intervention (target: 90%)
• Mean time to resolution: Median time from case creation to closure (target: under 5 minutes)
• Escalation rate by specialist: Tracks which agents escalate most frequently
• Retrieval precision: Percentage of retrieved cases that informed successful resolutions
• Tool call success rate: Percentage of tool calls that complete without errors

The observability stack uses CloudWatch for metrics, X-Ray for distributed tracing, and a custom dashboard for agent-specific KPIs. Each specialist agent emits structured logs with case ID, agent ID, and resolution outcome.

When automation rate drops below 85%, the team reviews episodic memory for new case patterns and updates routing rules or specialist prompts.

Technical Verdict

Use this architecture when:

• You process high volumes of structured cases (thousands per month) with repeatable resolution patterns.
• You operate in a regulated environment requiring audit trails and human oversight.
• You need to expand across multiple domains without rewriting orchestration logic.
• You have historical case data to seed episodic memory.

Avoid this architecture when:

• Case volumes are low (under 100 per month). The overhead of multi-agent orchestration and episodic memory is not justified.
• Cases require deep reasoning or multi-step planning. Specialist agents work best for narrow, tool-heavy tasks.
• You cannot tolerate any autonomous actions. The 90% automation rate means 10% of cases still escalate, and some autonomous resolutions will be incorrect.
• You lack infrastructure for immutable audit logs and state persistence. Regulatory compliance depends on these guarantees.

The tiered agent model scales horizontally by adding specialists. The episodic memory model scales with case volume, but retrieval latency increases without vector indexing. Greenlight uses Amazon OpenSearch for semantic search and reports sub-200ms retrieval times at 50,000 stored cases.

This is not a general-purpose agent framework. It is a production system optimized for high-volume, structured case resolution in a regulated environment. The architecture trades flexibility for reliability and auditability.

Source Links

• Primary source: AWS Machine Learning Blog