Building an evidence-grounded agentic security operations harness on Cloudflare

This post details the architecture of a new AI agent harness for security operations, moving from a single-agent approach to a multi-agent system. Key technical contributions include: 1. A 'recon first, inference second' approach where deterministic code collects a versioned evidence snapshot before AI agent analysis. 2. A lightweight triage model using Clef (running on Workers AI) to filter out high-volume noise. 3. A coordinator AI agent orchestrating four specialist AI agents (traffic analysis, customer context, global telemetry, threat intelligence) in parallel. 4. A synthesis AI agent that combines typed findings from specialists into an advisory report. 5. Use of Cloudflare's developer platform (Workers, Workflows, D1, R2, Durable Objects) for evidence collection, validation, orchestration, state persistence, and artifact storage. 6. Mechanisms for handling incomplete evidence and distinguishing between 'not checked', 'checked with no match', and 'checked with evidence supporting absence'.