CVE advisory triage
Your security team drowns in vulnerability-feed noise: hundreds of CVE advisories a week, most irrelevant to your stack. Design a triage agent that maps advisories to affected services and ranks urgency. Missing one critical is far worse than a hundred false alarms — so how does that asymmetry shape its permissions, its thresholds, and what it's allowed to dismiss on its own? How do you evaluate it against historical advisories, and what's the pitch to the CISO?
triage_cve_advisories(severities: list[str], match_confidences: list[int], internet_exposed: list[bool]) → list[str][["critical","low","high"],[10,95,45],[false,true,false]]out["human_review","escalate","escalate"][["MEDIUM","medium"],[70,10],[false,false]]out["escalate","dismiss"][["low"],[95],[false]]out["dismiss"]Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.