Anomaly Radar
2. Anomaly Radar
The Anomaly Radar is a two-dimensional scatter plot visualization of all events where the L3 engine was triggered. It allows operators to visually identify clusters of high-risk behavioral anomalies.
2.1 Scatter Plot
Each point on the chart represents a single L3-escalated event. The axes are:
- X-axis — Policy Divergence % — How far the interaction drifted from the guard's constitutional baseline (0–100%)
- Y-axis — Syntactic Drift (L2 Proxy) % — Structural deviation from expected domain output patterns (0–100%)
Color Coding by Severity
| Color | Severity | Threshold |
|---|---|---|
| Red | Critical | Divergence > 80% AND Syntactic drift > 80% |
| Orange | High | Divergence > 70% OR Syntactic drift > 70% |
| Copper | Medium | Divergence > 40% OR Syntactic drift > 40% |
| Gray | Low | Below thresholds |
2.2 Tooltip
Hovering over any scatter point shows a tooltip with:
- Anomaly ID
- Severity badge
- Guard name
- Policy Divergence %
- Syntactic Drift (L2 Proxy) %
- Detection time (UTC)
2.3 Filtering
The Anomaly Radar supports filtering by:
- Guard — Show only anomalies from a specific guard kernel
- Severity — Filter by critical, high, medium, or low
- Search by Anomaly ID — Locate a specific event in the scatter plot
2.4 Empty State
If no L3-triggered anomalies exist in the current filter set, the chart displays an empty state message confirming that the system is healthy and no anomalies are currently detected.