Explained by authorization
noulDoes a valid, matching authorization or maintenance record explain the observed activity?
Jev example · Security triage
The alert with almost no evidence
Give the model an explicit incomplete-information case.
Workflows & decisionsnoulchoicescore
State
This is the context Jev receives before answering the typed question.
{
"alert": "Unusual process activity",
"asset": "unknown",
"process_details": null,
"owner": null,
"authorization_lookup": "failed"
}Typed questions (3)
Triage route
choiceSelect a review route from available evidence. Do not execute any containment.
- close | Documented benign activity
- investigate | Ambiguous or incomplete evidence
- urgent_review | Strong indicators of active unauthorized activity
Evidence strength
scoreHow strong is the evidence of unauthorized activity?
- Benign or no supporting evidence
- Weak signal
- Multiple credible signals
- Direct evidence of compromise
Try changing the scenario
Add a known owner and the process command summary.
Catalog source: TypeSafeAI/typesafe-playground, reused under MIT. This is an independent community catalog, not an official TypeSafe AI product.
Background source: Inspired by TypeSafe workflow evals; examples authored for this playground