Jev example · Security triage

A suspicious mailbox rule

Combine several signals instead of one isolated warning.

Workflows & decisionsnoulchoicescore

State

This is the context Jev receives before answering the typed question.

{
  "alert": "New rule forwards all finance email externally",
  "actor": {
    "new_device": true,
    "mfa_bypassed": true
  },
  "rule": {
    "destination": "external@example.invalid"
  },
  "approved_request": null
}

Typed questions (3)

Explained by authorization

noul

Does a valid, matching authorization or maintenance record explain the observed activity?

Try in Playground

Triage route

choice

Select a review route from available evidence. Do not execute any containment.

Try in Playground

close | Documented benign activity
investigate | Ambiguous or incomplete evidence
urgent_review | Strong indicators of active unauthorized activity

Evidence strength

score

How strong is the evidence of unauthorized activity?

Try in Playground

Benign or no supporting evidence
Weak signal
Multiple credible signals
Direct evidence of compromise

Try changing the scenario

Add a matching, verified migration request.

Catalog source: TypeSafeAI/typesafe-playground, reused under MIT. This is an independent community catalog, not an official TypeSafe AI product.

Background source: Inspired by TypeSafe workflow evals; examples authored for this playground

Browse all examples Load first question