Jev example · Security triage

An impossible-travel login

Avoid treating an alert label as proof.

Workflows & decisionsnoulchoicescore

State

This is the context Jev receives before answering the typed question.

{
  "alert": "Two logins 4 minutes apart from distant regions",
  "context": {
    "vpn_exit_node": true,
    "mfa_passed": true,
    "known_device": true
  },
  "authorization": null
}

Typed questions (3)

Explained by authorization

noul

Does a valid, matching authorization or maintenance record explain the observed activity?

Try in Playground

Triage route

choice

Select a review route from available evidence. Do not execute any containment.

Try in Playground

close | Documented benign activity
investigate | Ambiguous or incomplete evidence
urgent_review | Strong indicators of active unauthorized activity

Evidence strength

score

How strong is the evidence of unauthorized activity?

Try in Playground

Benign or no supporting evidence
Weak signal
Multiple credible signals
Direct evidence of compromise

Try changing the scenario

Set known_device and mfa_passed to false.

Catalog source: TypeSafeAI/typesafe-playground, reused under MIT. This is an independent community catalog, not an official TypeSafe AI product.

Background source: Inspired by TypeSafe workflow evals; examples authored for this playground

Browse all examples Load first question