SI-Agent: A Modular Agentic Framework

• SI-Agent is an agentic system that decomposes complex control problems into specialized agents interacting through iterative, feedback-driven processes.
• It is demonstrated across LLM instruction tuning, security operations, and aspective information containment with validated performance and interpretability.
• Its modular architecture and tunable trade-offs between effectiveness and human readability offer robust, policy-enforced solutions for dynamic environments.

An SI-Agent is an agentic system—appearing in several domains—which coordinates multiple specialized agents to autonomously sense, process, and act on information in complex environments, typically leveraging iterative, feedback-driven algorithms. SI-Agent frameworks have been formally defined and empirically validated in three principal research threads: (1) feedback-driven human-readable system instruction generation for LLMs (Challagundla, 3 Jul 2025), (2) agentic automation in security operations contexts (Roy et al., 22 Apr 2026), and (3) aspective agentic architectures for strict information containment in partially observable environments (Bentley et al., 3 Sep 2025).

1. Formal Foundations and Problem Statements

The essential mathematical structure of an SI-Agent involves the decomposition of a complex optimization or control problem into a network of specialized agents, each interacting through well-defined data flows and policy constraints.

For SI generation in LLMs, let $\mathcal{S}$ be the space of human-readable system instructions. The SI-Agent’s objective is to find $s^*\in\mathcal{S}$ that maximizes an explicit composite reward: $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$ where $P(s)$ is a task performance metric (e.g., accuracy, BLEU, Pass@k), $R(s)$ denotes normalized SI readability (e.g., Flesch Reading Ease, LLM-judge, or human ratings), and $\alpha\in[0,1]$ controls the performance-readability tradeoff (Challagundla, 3 Jul 2025).

Analogously, in agentic security automation, the SI-Agent $\mathcal{A} = (P, R, H, V, A)$ comprises:

• $P$: Perception module mapping raw alerts to enriched incident objects,
• $R$: Reasoning layer generating candidate attack hypotheses,
• $V$: Structural validator filtering hypotheses by feasibility,
• $s^*\in\mathcal{S}$0: Risk-based action planner producing executable playbooks (Roy et al., 22 Apr 2026).

For aspective information control, the formalization involves a global environment $s^*\in\mathcal{S}$1, a family of aspect projection functions $s^*\in\mathcal{S}$2, and a set of agents $s^*\in\mathcal{S}$3, yielding the system tuple $s^*\in\mathcal{S}$4. Each agent acts based exclusively on its aspect $s^*\in\mathcal{S}$5 and proposes changes via minimal deltas $s^*\in\mathcal{S}$6 subject to global policy enforcement (Bentley et al., 3 Sep 2025).

2. SI-Agent Architectures and Data Flow

SI-Agent architectures display modular, layered designs with explicit agent roles. In the feedback-driven SI optimization setting, three core agents participate in a closed loop:

• Instructor Agent: Proposes or edits system instructions based on prior feedback.
• Instruction Follower Agent: Executes the downstream task(s) with the candidate SI to generate outputs.
• Feedback/Reward Agent: Evaluates both performance ($s^*\in\mathcal{S}$7) and readability ($s^*\in\mathcal{S}$8) of candidate SIs, issuing critiques guiding subsequent iterations.

The architecture is generally agentic and cyclic, following this data flow:

From	To	Artifact
Instructor	Follower	System instruction $s^*\in\mathcal{S}$9
Follower	Feedback	Model responses
Feedback	Instructor	$\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$0

Architectures supporting security automation contain analogous patterns:

• Perception Layer: Normalizes and contextualizes alerts.
• Agentic Reasoning Layer: Applies LLMs and structural simulations to generate and filter hypotheses.
• Action Layer: Sequences and executes mitigations, constrained by risk evaluation and policy (Roy et al., 22 Apr 2026).

Aspective SI-Agent systems partition the environment's knowledge into policy-regulated aspects, each processed independently by their agents and only updated via regulated, auditable deltas (Bentley et al., 3 Sep 2025).

3. Algorithmic Procedures and Iterative Optimization

At the core of SI-Agent operational logic are iterative and/or event-driven loops. In feedback-driven SI generation for LLMs, the refinement process is:

1. Initialize $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$1.
2. For $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$2 (or until convergence):
   • Instructor refines $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$3 based on $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$4.
   • Follower executes $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$5, computes $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$6.
   • Feedback agent rates $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$7; generates structured feedback $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$8.
   • Compute $\text{Reward}(s) = \alpha\,P(s) + (1-\alpha)\,R(s)$9; select best $P(s)$0 across iterations.

Pseudocode (abridged) (Challagundla, 3 Jul 2025): $R(s)$1

In agentic SOC, the loop consists of continual sense-reason-act stages over alert streams, with real-time hypothesis updating, risk scoring, and policy-guarded action execution (Roy et al., 22 Apr 2026).

Aspective SI-Agents operate asynchronously, reacting to environment updates via the following high-level logic (Bentley et al., 3 Sep 2025): $R(s)$2

4. Evaluation Metrics and Empirical Results

Evaluation is multi-dimensional, focusing on both effectiveness and interpretability.

For SI optimization in LLMs, key metrics include:

• Task performance ($P(s)$1): accuracy, exact match (EM), BLEU, Pass@k
• SI readability ($P(s)$2): normalized Flesch, LLM-judge, or human ratings
• Efficiency: iterations to convergence, total LLM calls/tokens

Experimental results on test domains (reasoning, coding, style transfer, tool use) are summarized:

Task/Metric	Zero-Shot	Manual SI	APE/OPRO	Prompt Tuning	SI-Agent
GSM8K Acc (%)	18.5	74.2	78.5	82.1	79.5
SI Readability (FRE/4)	—	0.62	0.58	—	0.67
HumanEval Pass@1 (%)	15.1	48.3	55.6	65.2	60.8
SI Readability (human)	—	0.78	0.72	—	0.86
GYAFC BLEU	12.3	18.5	19.1	21.5	19.9
SI Readability (human)	—	0.84	0.80	—	0.88

SI-Agent outperforms zero-shot and manual SI on readability, offers performance comparable to APE/OPRO while producing more interpretable instructions, and converges in 20–50 iterations (5K–10K LLM calls), in contrast to weeks of human tuning (Challagundla, 3 Jul 2025).

AgentSOC SI-Agents for SOC automation demonstrated consolidated incident detection, attack intent prediction at high confidence ($P(s)$3), and triage latencies on the order of $P(s)$4 ms, with policy-based action ranking yielding clear risk-effectiveness tradeoffs (Roy et al., 22 Apr 2026).

In aspective architectures, information leakage rates under adversarial attempts were empirically reduced to $P(s)$5, with up to $P(s)$6 leakage occurring in non-aspective baseline multi-agent chat systems (Bentley et al., 3 Sep 2025).

5. Trade-offs, Limitations, and Security Considerations

A central SI-Agent tradeoff is the structural tunability between effectiveness and interpretability. The hyperparameter $P(s)$7 governs this: $P(s)$8 emphasizes performance at the expense of readability, $P(s)$9 optimizes human clarity at possible performance cost. Empirically, minor drops in task metrics are offset by substantial readability gains (Challagundla, 3 Jul 2025).

Computational and feedback costs remain significant:

• Multiple LLM invocations (Instructor, Follower, Judge) per iteration
• Feedback reliability issues (LLM-as-judge subjectivity, metric noise)
• Mitigation strategies: batch evaluations, lightweight evaluation models, human-in-the-loop oversight

In information containment applications, aspective SI-Agent architectures enforce strict policy projections ($R(s)$0), asynchronous event-driven logic, and priority ordering in conflicting updates. Security "by design" is achieved, as each agent is cryptographically and functionally restricted to its projected aspect, precluding prompt-injection or privilege escalation leakage paths. Empirical results in COVID-19 data disclosure and policy-update attacks demonstrate zero leakage under all tested adversarial scenarios (Bentley et al., 3 Sep 2025).

6. Implications, Modularity, and Broader Applications

SI-Agent frameworks democratize key processes such as LLM prompt engineering, lowering the barrier to effective system customization by enabling feedback-driven, human-readable instruction tuning from minimal task specifications (Challagundla, 3 Jul 2025). They support expanded transparency, as interpretable SIs can be directly audited and debugged, in contrast to gradient-based prompt tuning. The architecture is modular: Instructor agents can be implemented via LLM meta-prompting, evolutionary search, or rule-based heuristics; reward functions can be extended with richer task- or preference-models and allow for human oversight.

Security automation SI-Agents yield adaptive, explainable, risk-aware SOC automation, bridging LLM-based generative reasoning and robust action planning rooted in policy and impact metrics (Roy et al., 22 Apr 2026).

Aspective SI-Agent architectures display unique benefits in dynamic, partially observable systems by combining rigorous, bottom-up access control with environmental awareness, supplying provable guarantees of information flow and operational efficiency (Bentley et al., 3 Sep 2025).

In sum, the SI-Agent paradigm unites principled, agentic optimization and control across domains, with strong empirical and formal evidence for its effectiveness, interpretability, and extensibility. Future areas of development include advanced feedback modeling, hierarchical agentic frameworks, and further integration with human-centric evaluation loops.