Show HN: An autonomous SOC built to refuse causation it can't prove

DomeSOC, an autonomous security operations center founded by Mohammad Khubaib, uses an independent grounding gate to grade every AI claim against actual evidence, flagging unsupported claims before action. The system features four specialist investigators, a devil's-advocate for benign cases, and tamper-evident audit trails, with per-tenant calibration for precision.

DomeSOC investigates, decides, and contains threats — and an independent gate grades every claim its AI makes against the actual evidence, flagging what it can't support. Calibrated to your environment. Every action sealed in a tamper-evident audit trail. DomeSOC can. An independent grounding gate reads every claim — from each investigation agent and the decision advisor — and grades it against the detection's actual evidence. Claims it can't support are flagged and stripped , and the analyst sees exactly what's proven, what's hypothesis, and what the AI over-reached on. The gate is independent of the AI it checks. Honest rebuttals "no evidence of beaconing" are recognized as rebuttals, not penalized — so the flags you see are real over-reaches, not noise. Every flagged claim is recorded per component and queryable. When we change a prompt, we measure whether over-claims went up or down — and only ship it if they didn't. When the AI recommends isolating a host, you can see which claims are evidence-backed and which were stripped — before you, or your policy, act on it. Four specialists investigate each detection in parallel, plus a devil's-advocate whose only job is to argue the benign case so nothing goes unchallenged. Their findings feed the decision advisor — and then the grounding gate grades every claim they made against the evidence. The gate's flags and your analysts' approve / dismiss decisions feed a per-tenant false-positive profile and entity reputation. The AI gets more precise on your environment — your noisy entities, your assets, your patterns. It's a mechanism that compounds with use, not a number we ask you to take on faith. Four specialist agents work the detection in parallel — plus a devil's-advocate that argues the benign case so nothing goes unchallenged. A decision advisor weighs the evidence, the per-tenant calibration, and the kill-chain context into a single recommendation with a written rationale. Every claim — agents' and advisor's — is graded against the evidence. Unsupported claims are flagged and stripped before the decision is shown. On your approval, or autonomously by your policy, containment executes through the tools you already own. Every decision and its evidence chain is hash-chained and sealed to S3 Object-Lock compliance mode on resolve — write-once, independently verifiable. Three tiers — recommend-only, autonomous-above-threshold, full-autonomous — and you set the level independently for each response action. Every detection gets a written threat assessment; every action a plain-English reason, with the graded claims behind it. Response executes where your team already works. "Live" means wired to a real path — not a logo on a grid. Mohammad Khubaib — Founder Autonomous decision architecture · per-tenant calibration forensic-grade audit preservation Patent pending — US provisional filed