THE FIELD GUIDE / AI & THROUGHPUT
Exact-match known-good reuse
Reuse a validated safe assessment across servers without paying for the same eligible investigation again.
Match the whole relevant context
A versioned canonical fingerprint includes verified artifact bytes, relevant script/interpreter/library/configuration identities, package/vendor provenance and versions, effective behavior and security-relevant context. Privilege/account semantics, startup command/trigger, network/service/container context and required follow-up evidence participate where relevant. Host IDs and proven observation-only differences such as PID/time are retained locally without preventing a genuine cross-server match.
Reuse only a completed eligible result
Only completed, validated safe/known-good assessments whose evidence and sharing scope permit reuse enter the fleet cache. Pending, failed, partial, suspicious and unknown outcomes are excluded. An eligible hit performs no provider call or duplicate AI budget reservation and is clearly marked Cached known good with the original explanation and source. Another server or calendar day does not itself force periodic re-triage.
Keep provenance and local observations
Each hit records the receiving server/observation, originating run and evidence, fingerprint version, matching fields, classification, confidence, limitations and reuse time. AI-derived assessments remain distinct from an explicit administrator known-good approval. Source evidence and minimum provenance survive ordinary log pruning; tenant/role/sharing boundaries still apply.
Invalidate when something changes
Changes to bytes, provenance, privilege, behavior, configuration, required follow-up evidence, applicable threat evidence or model/prompt/policy eligibility prevent reuse. Revoking a shared entry blocks later hits and marks linked assessments for review without rewriting history. New incident and detector evidence always remains visible; a cached verdict does not suppress it.
Review a revocation or contradiction
Administrator invalidation requires the current entry revision, an explicit reason and confirmation of fleet scope. A complete retained provider assessment that contradicts the identical verified context also blocks future reuse and links the contradictory result. Source and receiving-server assessments retain their original conclusions with a visible review marker. Partial results, a different context or a changed model/policy are not silently treated as a matching contradiction.
Request a fresh re-triage
Administrators can explicitly Re-triage a completed or cached safe observation, bypassing lookup for that observation while honoring pause, sharing, rate and spend controls. Refreshing one observation is distinct from revoking or replacing a fleet trust entry; fleet changes require explicit scope and an audit record. A new suspicious or unknown result revokes the corresponding reusable safe entry and schedules linked review.
Keep protection independent
Normal collection, integrity checks, signature scanning and deterministic response continue after a cache hit. Retained/local assessment lookup can remain available while provider AI is paused, but cannot widen evidence sharing or authorize a new provider call. No cached result is a clean-host certificate or permission to take a destructive action.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗