The Agentic AI Framework (AAIF): a policy-enforced architecture for accountable and high-performance intrusion detection

Abstract

Artificial intelligence plays a central role in modern cybersecurity, yet systems optimized for detection accuracy often lack mechanisms for accountability, transparency, and policy compliance. This study proposes the Agentic AI Framework (AAIF), a policy-aware intrusion detection architecture that integrates predictive modeling with executable governance. Guided by Design Science Research, the framework combines a deep learning detection model with a governance layer aligned to the NIST AI Risk Management Framework 2.0. A key component is an interpretable Policy Engine that enforces operational and ethical constraints through a declarative YAML-based domain-specific language, ensuring that each decision is auditable and policy-compliant. The framework was evaluated on the CICIDS2017 dataset, which contains over 2.8 million network flow records across benign and malicious traffic. Results show that AAIF preserves predictive performance relative to baseline models, including Random Forest, Support Vector Machine, and Deep Neural Network, achieving a weighted F 1-score of 0.483 and an AUROC of 0.978. At the same time, the framework achieved complete compliance under the defined policy schema, with an Ethical Compliance Rate of 1.0 and a False Escalation Rate of 0.0. The Governance Compliance Index improved from 0.947 to 0.983, demonstrating stronger alignment between system decisions and governance requirements. These findings show that policy-enforced inference can support accountable autonomy without degrading detection capability. The AAIF provides a reproducible and governance-aware approach that transforms conventional intrusion detection systems into transparent and auditable decision systems. This work establishes a practical foundation for deploying policy-aligned AI in cybersecurity environments.