KSKS Security Research
Learning map / Session 3 / Scenes 01–08, 18

ORCHESTRATOR 01 · PRODUCT MODEL

The model is replaceable.The delivery system is the asset.

Understand how one governed control spine coordinates specialist cybersecurity skills, deterministic gates, artifacts, and human decisions.

cyber orchestratorcontrol planeskillsdelivery
Learning guide
Level
Start here
Reading time
12 min
Presentation
Session 3
Progress
1 of 5

01 · Mental model

The orchestrator owns workflow; skills own expertise

The orchestrator accepts a scoped request, establishes run identity and policy, routes bounded tasks to specialist skills, validates typed artifacts, records decisions, and assembles the final delivery pack. Specialist instructions can evolve without moving authority out of the control plane.

Value comes from consistent evidence, fewer assembly gaps, faster review, reusable specialist methods, and clearer accountability—not merely generating documents faster.

02 · Visual explanation

01Orchestratoridentity + policy + state
02Doc builderdelivery pack
03Architectfindings + decisions
04DetectionKQL + validation
05Compliancecontrol mapping
One control spine, several specialist capabilitiesSpecialists exchange typed artifacts through the orchestrator rather than conversing without control.

03 · Compare and decide

Automation versus governed orchestration

Decision lensLoose assistant workflowGoverned control plane
ScopeReconstructed in promptsTyped intake and explicit non-goals
ExpertiseOne large instructionVersioned specialist skills
HandoffsFree-form conversationValidated artifacts with lineage
AuthorityImplicit in tool accessPolicy, approvals, and separate execution identities

04 · Cybersecurity example

From one request to an HLD and delivery plan

A customer asks for a Sentinel implementation design with architecture, work plan, detections, and governance.

01

Intake normalizes scope and evidence.

02

Specialists produce architecture, controls, and detection artifacts.

03

Gates validate schemas and surface disagreements.

04

The document builder assembles an editable, traceable pack.

Outcome: The system reduces assembly effort while preserving specialist review and decision evidence.

05 · What to remember

The 60-second recall

01

Centralize authority while distributing expertise.

02

Measure review quality, rework, defects, and safe failure—not number of agents.

03

Keep models replaceable behind stable contracts and artifacts.

Teach-back prompt: Explain this concept to a teammate using the diagram, then name one failure mode and the control that stops it.

06 · Questions people ask

FAQ

It may use model reasoning, but its defining role is the application control plane: routing, state, policy, validation, evidence, and lifecycle.

07 · Primary sources

Continue with authoritative guidance