Decision Model Reference
The POST /v1/decide engine runs a deterministic pipeline. No learned weights, no randomness — the same inputs always produce the same output. This page documents the lookup tables that drive every decision.
This is the current V1 evaluator model. Thresholds may calibrate over time without changing the API contract.
All actions sit on a five-point severity scale. Interaction shift and confidence clamps move the final action up this ladder. It never moves down.
A routing table result of sandbox with a high-tier interaction shift of +1 produces escalate_to_human. Actions are capped at deny (severity 5).
Interaction tier
Sum kind score + mode score + sensitivity score. Total maps to tier: 1–2 = low, 3–4 = medium, 5–6 = high, 7+ = critical.
| navigate | +1 |
| fetch | +1 |
| enrich | +2 |
| download_file | +3 |
| submit_credentials | +4 |
| initiate_payment | +5 |
| read_only | +0 |
| transactional | +1 |
| privileged | +2 |
| low | +0 |
| medium | +1 |
| high | +2 |
| critical | +3 |
| Total score | Tier |
|---|---|
| 1 – 2 | low |
| 3 – 4 | medium |
| 5 – 6 | high |
| 7+ | critical |
Target state classifier
Evaluated in priority order A → E → D → C → B → F. First match wins. Score bands: low ≤39, medium 40–69, high ≥70. Confidence bands: low <0.55, medium 0.55–0.79, high ≥0.80.
Threat high, confidence strong.
Deviation high, trust weak.
Sparse or low-confidence signals.
Strong trust and strong negative signals coexist.
Strong trust, low threat, low deviation.
No dominant safe or threat state.
Policy routing table
Base action before interaction shift. Rows = target state, columns = policy profile. Click any cell to trace the full evaluation path for that combination.
| State | Name | open | balanced | strict | critical |
|---|---|---|---|---|---|
| A | Clear Threat | ||||
| B | High Anomaly | ||||
| C | High Uncertainty | ||||
| D | Conflicting Signals | ||||
| E | Safe Known | ||||
| F | Mixed / Reviewable |
Click any cell to trace the full evaluation path for that state × policy combination.
Interaction shift
The base action from the routing table is shifted up the severity ladder based on interaction tier.
| Tier | Shift | Notes |
|---|---|---|
| low | +0 | Base action unchanged. |
| medium | +0 | Base action unchanged. |
| high | +1 | One step up the severity ladder. |
| critical | +1 (State A: +2) | One step up; two steps for State A to force deny. |
Confidence clamps
Terminal overrides applied after routing and shift. Evaluated in order; first matching clamp applies.
If action is deny but max confidence across threat and deviation is below 0.70, downgrade to escalate_to_human.
deny is reserved for structurally strong negative evidence. Without that confidence, hard blocking is replaced by human escalation.
If uncertainty = high AND tier is high or critical, floor the action at escalate_to_human.
High-stakes interactions under high evidence uncertainty always surface to a human, regardless of what the routing table returned.
Temporal state
Every /v1/decide response includes a temporal_state block built from longitudinal domain history scoped to your account. Comparable, recent measurements can strengthen a recommendation when threat rises sharply or independent evidence corroborates an identity change. Cached requests reuse the original observation instead of adding evidence.
Qualified memory evidence changes proceed or proceed_with_caution to sandbox for read-only interactions, or escalate_to_human for transactional and privileged interactions. Existing sandbox, escalation, and deny decisions are preserved. These rules require a current observation within 24 hours and comparable history within seven days; unavailable or stale history does not change the recommendation. Memory alone never creates a deny decision or increases action confidence.
One sentence describing the available history in your account. Repeated or unchanged observations do not establish safety.
"This state matches the previous distinct observation in your account."
Rounded percentage of the public research sample sharing this state, using each domain's latest observation from the last seven days and the same scoring version. null when the baseline is unavailable or over 36 hours old. This is prevalence, not a safety ranking.
50 → half of the eligible public research domains share this state
Distinct persisted observations of this domain in your account through the current measurement. Cached requests do not increase the count. null when history is unavailable or the bounded result cannot establish a complete count.
6
Whether the previous distinct observation has a canonical state key and the same scoring version. history_available separately reports whether the private history read succeeded.
false → do not infer a state change from missing or incompatible history
Share of observed outgoing transitions from the previous state that reach the current state in public research for the same scoring version. Requires comparable private history, at least 20 outgoing samples, and an aggregate updated within 36 hours. null when unavailable; state prevalence is never substituted.
0.75 → 75% of observed outgoing transitions match this transition
Reports available, stale, or unavailable public statistics. transition_status can also be insufficient_data. Refresh timestamps and transition_sample_count provide the supporting context.
"unavailable" / "insufficient_data"
Compatibility field fixed at 1. Memory policy uses qualified changes and explicit reason codes rather than multiplying risk by prevalence or observation count.
1
True when comparable, distinct observations differ in state and are less than seven days apart. This flag alone does not establish malicious behavior or change the recommendation.
false
Demo playground results use public research baselines only. Private domain history requires an authenticated /v1/decide call and is scoped to the account that owns the API key. The memory_observation response field identifies the persisted measurement and its original timestamp and scoring version; it is null when no verified observation is available.
End-to-end example
A credential-submission interaction against a structurally anomalous domain under balanced policy.