Not a scanner: the cognitive cycle of a security agent

A classical scanner executes a predetermined list of checks and emits whatever matched. It cannot reason about a target it has never seen, it cannot revise a belief when the evidence contradicts it, and — most importantly — it cannot tell you honestly when it simply does not know. It reports possibilities and leaves the triage to you.

ROOTVIEL reframes an assessment as a stateful investigation with bounded autonomy: an agent that observes, maintains an explicit model of what it believes and why, proposes and tests hypotheses, and terminates with a verdict that distinguishes what was proven from what remains unknown.

The agent model is the Belief–Desire–Intention (BDI) architecture, extended with an explicit epistemic layer that tracks the status of every belief. Each belief carries a confidence value and an epistemic status that constrains what it is allowed to become.

OBSERVED

Directly measured from the target or a tool result.

INFERRED

Derived by reasoning. A statement produced by a language model can only ever be INFERRED — never promoted to OBSERVED.

ASSUMED

Taken as a working premise, explicitly flagged as such.

DISPROVED

Contradicted by evidence; lowers the belief rather than silently dropping it.

UNKNOWN

Not established. A first-class outcome, never a failure state.

1. 1Observe the target and build context.
2. 2Update beliefs; maintain desires (goals) and intentions (plans).
3. 3Reason: propose, rank, critique, support, weaken or supersede hypotheses — deterministically, without calling a model to decide.
4. 4Select the next action by information gain — but only after the gate.
5. 5Authorize through the tool gate (security precedes usefulness).
6. 6Act, and observe the result as new evidence.
7. 7Verify the evidence with a deterministic verifier.
8. 8Update the hypothesis; replan, or terminate.

Autonomy is always bounded. A budget caps actions, cycles, failed hypotheses, tokens and wall-clock time. A stagnation detector halts the loop when it sees the same action signature repeat. And when the budget is exhausted, the verdict is UNKNOWN — never a hopeful CONFIRMED. An investigation that ran out of room says so.

This is the anti-"agent-washing" discipline: an agent is not a chatbot with tool-calls bolted on. It is a loop with beliefs, a gate it cannot skip, a verifier it cannot overrule, and a budget it cannot exceed.

Consider a command-injection mission. A taint reasoner emits observations about user input reaching a shell sink. The agent forms the hypothesis "possible command injection", updates its beliefs, and enumerates candidate actions — for instance, request a dataflow-provenance proof, or execute a controlled proof in a sandbox. Each candidate passes the tool gate before it is ranked. The chosen action produces evidence; a deterministic verifier settles it; the belief updates. The mission terminates CONFIRMED only when a real, sandboxed proof exists — not because the reasoning "looked right".