{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,7]],"date-time":"2026-09-07T14:26:46Z","timestamp":1788791206288,"version":"build-2803163510"},"reference-count":47,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T00:00:00Z","timestamp":1780531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:p>\n                    Artificial intelligence plays a central role in modern cybersecurity, yet systems optimized for detection accuracy often lack mechanisms for accountability, transparency, and policy compliance. This study proposes the Agentic AI Framework (AAIF), a policy-aware intrusion detection architecture that integrates predictive modeling with executable governance. Guided by Design Science Research, the framework combines a deep learning detection model with a governance layer aligned to the NIST AI Risk Management Framework 2.0. A key component is an interpretable Policy Engine that enforces operational and ethical constraints through a declarative YAML-based domain-specific language, ensuring that each decision is auditable and policy-compliant. The framework was evaluated on the CICIDS2017 dataset, which contains over 2.8 million network flow records across benign and malicious traffic. Results show that AAIF preserves predictive performance relative to baseline models, including Random Forest, Support Vector Machine, and Deep Neural Network, achieving a weighted\n                    <jats:italic>F<\/jats:italic>\n                    1-score of 0.483 and an AUROC of 0.978. At the same time, the framework achieved complete compliance under the defined policy schema, with an Ethical Compliance Rate of 1.0 and a False Escalation Rate of 0.0. The Governance Compliance Index improved from 0.947 to 0.983, demonstrating stronger alignment between system decisions and governance requirements. These findings show that policy-enforced inference can support accountable autonomy without degrading detection capability. The AAIF provides a reproducible and governance-aware approach that transforms conventional intrusion detection systems into transparent and auditable decision systems. This work establishes a practical foundation for deploying policy-aligned AI in cybersecurity environments.\n                  <\/jats:p>","DOI":"10.3389\/frai.2026.1755696","type":"journal-article","created":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T05:41:58Z","timestamp":1780551718000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["The Agentic AI Framework (AAIF): a policy-enforced architecture for accountable and high-performance intrusion detection"],"prefix":"10.3389","volume":"9","author":[{"given":"Ibrahim","family":"Adabara","sequence":"first","affiliation":[{"name":"Department of Computing, Faculty of Science and Technology, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bashir Olaniyi","family":"Sadiq","sequence":"additional","affiliation":[{"name":"Department of Electrical, Telecommunication, and Computer Engineering, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aliyu Nuhu","family":"Shuaibu","sequence":"additional","affiliation":[{"name":"Department of Electrical, Telecommunication, and Computer Engineering, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yale Ibrahim","family":"Danjuma","sequence":"additional","affiliation":[{"name":"Department of Computing, Faculty of Science and Technology, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Venkateswarlu","family":"Maninti","sequence":"additional","affiliation":[{"name":"Department of Computing, Faculty of Science and Technology, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mutebi","family":"Joe","sequence":"additional","affiliation":[{"name":"Department of Computing, Faculty of Science and Technology, Kampala International University","place":["Kampala, Uganda"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,6,4]]},"reference":[{"key":"ref1","doi-asserted-by":"publisher","first-page":"1497535","DOI":"10.3389\/FDATA.2024.1497535","article-title":"Advancing cybersecurity and privacy with artificial intelligence: current trends and future research directions","volume":"7","author":"Achuthan","year":"2024","journal-title":"Front. Big Data"},{"key":"ref2","doi-asserted-by":"publisher","first-page":"843","DOI":"10.12688\/F1000RESEARCH.169337.1","article-title":"A review of agentic AI in cybersecurity: cognitive autonomy, ethical governance, and quantum-resilient defense","volume":"14","author":"Adabara","year":"2025","journal-title":"F1000 Res."},{"key":"ref3","doi-asserted-by":"publisher","first-page":"170","DOI":"10.3126\/NPRCJMR.V1I9.74177","article-title":"Explainable AI for cyber security: interpretable models for malware analysis and network intrusion detection","volume":"1","author":"Adhikari","year":"2024","journal-title":"NPRC J. Multidiscipl. Res."},{"key":"ref4","doi-asserted-by":"publisher","first-page":"4357","DOI":"10.3390\/S25144357","article-title":"AI trustworthiness in manufacturing: challenges, toolkits, and the path to industry 5.0","volume":"25","author":"Ahangar","year":"2025","journal-title":"Sensors"},{"key":"ref5","doi-asserted-by":"publisher","first-page":"4170","DOI":"10.3390\/APP14104170","article-title":"XAI-IDS: toward proposing an explainable artificial intelligence framework for enhancing network intrusion detection systems","volume":"14","author":"Arreche","year":"2024","journal-title":"Appl. Sci."},{"key":"ref6","doi-asserted-by":"publisher","first-page":"04012","DOI":"10.1051\/E3SCONF\/202449104012","article-title":"Intrusion detection system using machine learning by RNN method","volume":"491","author":"Azarudeen","year":"2024","journal-title":"E3S Web of Conferences"},{"key":"ref7","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1007\/S43681-022-00178-0","article-title":"Ethical assurance: a practical approach to the responsible design, development, and deployment of data-driven technologies","volume":"3","author":"Burr","year":"2023","journal-title":"AI. Ethics"},{"key":"ref8","doi-asserted-by":"publisher","first-page":"e13406","DOI":"10.1111\/EXSY.13406","article-title":"Artificial intelligence governance: ethical considerations and implications for social responsibility","volume":"41","author":"Camilleri","year":"2024","journal-title":"Expert. Syst."},{"key":"ref9","author":"Catillo","year":"2023"},{"key":"ref10","first-page":"412","article-title":"Signature based rule matching technique in network intrusion detection system","volume":"2","author":"Chandrapal","year":"2012","journal-title":"Internat. J. Adv. Res. Comput. Sci. Soft. Engineer."},{"key":"ref11","doi-asserted-by":"publisher","first-page":"1421273","DOI":"10.3389\/FHUMD.2024.1421273","article-title":"Transparency and accountability in AI systems: safeguarding wellbeing in the age of algorithmic decision-making","volume":"6","author":"Cheong","year":"2024","journal-title":"Front. Human Dynam."},{"key":"ref12","doi-asserted-by":"publisher","first-page":"5278","DOI":"10.28919\/JMCS\/5921","article-title":"Intrusion detection system using deep learning methodologies","volume":"11","author":"Choubey","year":"2021","journal-title":"J. Math. Comput. Sci."},{"key":"ref13","first-page":"54","author":"D\u2019Aquin","year":"2018"},{"key":"ref14","first-page":"150","author":"Cerqueira","year":"2022"},{"key":"ref15","doi-asserted-by":"publisher","first-page":"852","DOI":"10.3390\/APP12020852","article-title":"On the detection capabilities of signature-based intrusion detection systems in the context of web attacks","volume":"12","author":"D\u00edaz-Verdejo","year":"2022","journal-title":"Appl. Sci."},{"key":"ref16","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/DESIGNS5010009","article-title":"Analysis, design, and comparison of machine-learning techniques for networking intrusion detection","volume":"5","author":"Dini","year":"2021","journal-title":"Designs"},{"key":"ref17","doi-asserted-by":"publisher","first-page":"78330","DOI":"10.1109\/ACCESS.2020.2989498","article-title":"Intelligent processing of intrusion detection data","volume":"8","author":"Duan","year":"2020","journal-title":"IEEE Access"},{"key":"ref18","author":"Ee","year":"2024"},{"key":"ref19","doi-asserted-by":"publisher","first-page":"3131153","DOI":"10.1155\/2022\/3131153","article-title":"Apache spark and deep learning models for high-performance network intrusion detection using CSE-CIC-IDS2018","volume":"2022","author":"Hagar","year":"2022","journal-title":"Comput. Intell. Neurosci."},{"key":"ref20","doi-asserted-by":"publisher","first-page":"100","DOI":"10.25156\/PTJ.V12N2Y2022.PP100-113","article-title":"Anomaly-based network intrusion detection system using deep intelligent technique","volume":"12","author":"Hassan","year":"2023","journal-title":"Polytech. J."},{"key":"ref21","doi-asserted-by":"publisher","first-page":"309","DOI":"10.1145\/3731596","article-title":"Intrusion detection based on federated learning: a systematic review","volume":"57","author":"Hern\u00e1ndez-Ramos","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2503.04739","article-title":"Responsible artificial intelligence systems: a roadmap to society\u2019s trust through trustworthy AI, auditability, accountability, and governance","author":"Herrera-Poyatos","year":"2025","journal-title":"ArXiv.Org."},{"key":"ref23","doi-asserted-by":"publisher","first-page":"37131","DOI":"10.1109\/ACCESS.2023.3266979","article-title":"A novel two-stage deep learning model for network intrusion detection: LSTM-AE","volume":"11","author":"Hnamte","year":"2023","journal-title":"IEEE Access"},{"key":"ref24","doi-asserted-by":"publisher","first-page":"905","DOI":"10.12688\/F1000RESEARCH.169927.1","article-title":"Trustworthy agentic AI systems: a cross-layer review of architectures, threat models, and governance strategies for real-world deployment","volume":"14","author":"Ibrahim","year":"2025","journal-title":"F1000Res"},{"key":"ref25","doi-asserted-by":"publisher","first-page":"88116","DOI":"10.1109\/ACCESS.2023.3306452","article-title":"AI-enabled trust in distributed networks","volume":"11","author":"Li","year":"2023","journal-title":"IEEE Access"},{"key":"ref26","volume-title":"Lecture Notes in Computer Science (Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)","author":"Liu","year":"2024"},{"key":"ref27","doi-asserted-by":"publisher","first-page":"1526221","DOI":"10.3389\/FRAI.2025.1526221","article-title":"A systematic review on the integration of explainable artificial intelligence in intrusion detection systems to enhancing transparency and interpretability in cybersecurity","volume":"8","author":"Mohale","year":"2025","journal-title":"Front. Artif. Intell."},{"key":"ref28","first-page":"362","author":"Nehinbe","year":"2010"},{"key":"ref29","first-page":"444","author":"Neufeld","year":"2022"},{"key":"ref30","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/S10676-022-09665-8","article-title":"Enforcing ethical goals over reinforcement-learning policies","volume":"24","author":"Neufeld","year":"2022","journal-title":"Ethics Inf. Technol."},{"key":"ref31","doi-asserted-by":"publisher","first-page":"112392","DOI":"10.1109\/ACCESS.2022.3216617","article-title":"Explainable intrusion detection systems (X-IDS): a survey of current methods, challenges, and opportunities","volume":"10","author":"Neupane","year":"2022","journal-title":"IEEE Acc."},{"key":"ref32","volume-title":"NIST AI 6001, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile Request for Comment","year":"2024"},{"key":"ref33","doi-asserted-by":"publisher","first-page":"1","DOI":"10.36948\/IJFMR.2024.V06I06.29183","article-title":"A survey of AI-powered proactive threat-hunting techniques: challenges and future directions","volume":"6","author":"Osinaike","year":"2024","journal-title":"Int. J. Multidiscip. Res."},{"key":"ref34","doi-asserted-by":"publisher","first-page":"195","DOI":"10.62311\/NESX\/RP05226","article-title":"Governing artificial intelligence: global standards for data sovereignty, cybersecurity, and ethical integrity","volume":"5","author":"Pasupuleti","year":"2025","journal-title":"Internat. J. Academ. Industr. Res. Innov."},{"key":"ref35","doi-asserted-by":"publisher","first-page":"2663","DOI":"10.3390\/APP8122663","article-title":"Chained anomaly detection models for federated learning: an intrusion detection case study","volume":"8","author":"Preuveneers","year":"2018","journal-title":"Appl. Sci."},{"key":"ref36","doi-asserted-by":"publisher","first-page":"7986","DOI":"10.3390\/APP12167986","article-title":"A one-dimensional convolutional neural network (1D-CNN) based deep learning system for network intrusion detection","volume":"12","author":"Qazi","year":"2022","journal-title":"Appl. Sci."},{"key":"ref37","doi-asserted-by":"publisher","first-page":"1568360","DOI":"10.3389\/FRAI.2025.1568360","article-title":"Generative AI cybersecurity and resilience","volume":"8","author":"Radanliev","year":"2025","journal-title":"Front. Artific. Intell."},{"key":"ref38","doi-asserted-by":"publisher","first-page":"255","DOI":"10.22214\/IJRASET.2021.37955","article-title":"Anomaly based intrusion detection system using machine learning","volume":"9","author":"Runwal","year":"2021","journal-title":"Int. J. Res. Appl. Sci. Eng. Technol."},{"key":"ref39","first-page":"733","volume-title":"Lecture Notes in Networks and Systems","author":"Satheesh Kumar","year":"2022"},{"key":"ref40","author":"Swaminathan","year":"2024"},{"key":"ref41","volume-title":"AI Risk Management Framework","author":"Tabassi","year":"2023"},{"key":"ref42","author":"Tallam","year":"2025"},{"key":"ref43","author":"Tallam","year":"2025"},{"key":"ref44","doi-asserted-by":"publisher","first-page":"229","DOI":"10.35629\/5252-0612229240","article-title":"Explainable AI for cyber security. Improving transparency and trust in intrusion detection systems","volume":"6","author":"Udofot","year":"2024","journal-title":"Int. J. Adv. Eng. Manage."},{"key":"ref45","doi-asserted-by":"publisher","first-page":"65356","DOI":"10.1109\/ACCESS.2025.3559325","article-title":"Intrusion detection in IoT networks using dynamic graph modeling and graph-based neural networks","volume":"13","author":"Villegas-Ch","year":"2025","journal-title":"IEEE Access"},{"key":"ref46","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3614424","article-title":"Exploiting blockchain to make AI trustworthy: a software development lifecycle view","volume":"56","author":"Zhang","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref47","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3539605","article-title":"Provenance-based intrusion detection systems: a survey","volume":"55","author":"Zipperle","year":"2023","journal-title":"ACM Comput. Surv."}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1755696\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T05:41:59Z","timestamp":1780551719000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1755696\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,4]]},"references-count":47,"alternative-id":["10.3389\/frai.2026.1755696"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1755696","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,4]]},"article-number":"1755696"}}