How the model decides, and how hard rules override it.
Triage Beacon uses Anthropic Claude via API, wrapped in the guardrails a security verdict demands: versioned prompts, evidence-only reasoning, deterministic policy overrides, and human confirmation on every case.
Confidence bands
The model returns a 0–1 probability estimate alongside every verdict. Bands determine the routing path, and thresholds are tunable per tenant.
Four verdicts
Policy rules (applied after the model, cannot be bypassed)
| Rule | Trigger | Effect |
|---|---|---|
| POL-001 | privileged_anomalous_signin + severity=critical | Force escalated; a human reviews every privileged compromise |
| POL-003 | ip_reputation.known_malicious=true | Force true_positive, confidence ≥ 0.95 |
| POL-004 | Enrichment coverage < 50% (not already TP/escalated) | Downgrade to inconclusive; no confident verdict on thin evidence |
| POL-005 | Confidence < 0.50 and verdict was false_positive | Force inconclusive; low-confidence closes are blocked |
These rules run in application code after the model responds. They change the verdict, the confidence, or the routing, and every rule that fires is recorded on the case and in the audit chain. Prompt engineering, model updates, and adversarial alert content cannot bypass them.
A versioned, cached, evidence-only prompt.
Versioned like a release
Every case records the prompt version that produced it (e.g. tb-v1.1.0). Prompt changes are evaluated against a golden dataset of labelled alerts before shipping, accuracy regressions block the release, exactly like failing tests.
Per-family playbooks
Each alert family carries its own triage playbook: what evidence matters for a risky sign-in differs from credential dumping. Playbooks encode base rates too, credential dumping biases heavily toward escalation because its true-positive rate is the highest of all families.
Prompt caching
The static system prompt and the per-family playbook are cached at the API layer; only the alert JSON and enrichment bundle vary per call. Cache reuse across the worker's 30-second batches keeps per-alert cost low and latency consistent.
Structured output, enforced
The assistant turn is pre-seeded with {, committing the model to raw JSON, no markdown fences, no prose. The response is schema-validated before anything touches the database; malformed output fails the case safely instead of corrupting it.
Evidence-only reasoning
The system prompt constrains the model to the evidence bundle it is given. It cannot browse, cannot call tools, and is instructed to return inconclusive rather than guess when evidence is missing, and POL-004 enforces that in code anyway.
Cost controls built in
Clearly informational noise, low severity with no recognized family, is closed deterministically without an AI call, at zero marginal cost. Real low-severity threats still get triaged because they match a known family.
Three layers between the model
and a closed case.
No single component is trusted alone. Three checks stand between a model response and a closed case.
The model recommends
Verdict, confidence, key evidence, and reasoning, grounded only in the enrichment bundle, under a versioned prompt.
Policy rules correct
Deterministic overrides correct the model wherever a hard security invariant applies, and record themselves on the case.
The analyst decides
Every case ends with a human confirm or override. The system has no autonomous-close path to enable.