AIGOAD: An Asynchronous Dual-Reasoning Architecture for AI-Assisted Active Directory Security Workflows

We present AIGOAD, an agentic security pipeline that transforms Active Directory attack-graph data into executable defensive enumeration workflows using large language models (LLMs). The system introduces an asynchronous dual-reasoning architecture in which a strategic model analyzes attack paths and defines investigative goals, while a tactical model independently generates concrete enumeration commands. By separating strategic analysis from command synthesis, AIGOAD allows strategic reasoning to occur intermittently using powerful remote models, while a lightweight local tactical component continues executing investigative workflows without requiring persistent communication with external services. This design reduces dependence on costly cloud inference while enabling continuous defensive validation of privilege relationships within Active Directory environments. To maintain operational safety, all commands are executed under a human-in-the-loop authorization model, ensuring that AI-generated commands cannot interact with systems without explicit operator approval.