Skip to content

Live Event Stream

1. Live Event Stream

The Live Event Stream is a continuously updating log of every drift event processed by the Theseus Guard engine. It is the most granular view of real-time AI interaction telemetry available in the platform.

1.1 Event Table

Each row in the event table represents a single guarded AI interaction. Columns include:

Column Description
Event ID Unique identifier for the event (monospaced, copyable)
Guard Target The name of the Guard kernel that evaluated this interaction
L1 Precedent L1 Precedent Decision Cache status: precedent match (fast-deny in Enforce), shadow observation (would-deny in Shadow), or cache miss.
L2 Confidence The L2 classifier's confidence score (0–1) in its verdict. Score bar with threshold at 0.4
L3 Badge indicating whether the L3 TG-Sentinel LLM evaluator was triggered for this event
Verdict The final enforcement verdict: compliant, drift, rejected, or pending
Date Timestamp of the event (UTC)

A LIVE indicator in the page header confirms that the stream is receiving real-time data.

The FilterBar allows operators to narrow the event stream by:

  • Search by Event ID — Find a specific event by its unique identifier
  • Guard — Filter events processed by a specific guard kernel
  • Verdict — Filter by enforcement outcome (compliant, drift, pending, rejected)
  • L3 Escalation — Show only events that triggered L3 evaluation, or only those that did not

1.3 Pagination & Sorting

The event table is paginated (15 events per page) and supports column-level sorting on:

  • Guard Target
  • L1 Precedent
  • L2 Confidence
  • Verdict
  • Date

Keyboard navigation is enabled — arrow keys can move between rows.

1.4 Event Detail (Side Sheet)

Clicking any event row opens a side sheet with the full event detail, organized across three tabs:

Summary Tab

  • Event verdict badge and unique event ID
  • Event Summary grid: timestamp, guard name, tenant ID, origin IP, model, template used
  • Watchpoints: any named behavioral flags that were triggered by this interaction
  • Force Route to Review button (hidden for viewer role) — manually escalates the event into the Runtime Reviews queue

Payload Tab

  • Request Payload — The full request body sent to the AI model, rendered as an interactive property tree
  • Response Payload — The AI-generated response as captured at enforcement time
  • Metadata — Any additional context attached to the event (expandable/collapsible tree viewer)

Analysis Tab

  • Analysis Scores: L1 Precedent disposition, L2 Confidence, L3 Confidence (if triggered), and SSC Severity score bars
  • L2 Reasoning — The textual explanation produced by the L2 classifier for its verdict
  • L3 Reason — The LLM evaluator's reasoning for its escalation decision
  • L3 Escalation Reason — The specific trigger that caused L3 escalation, shown with a severity badge
  • Derived Metrics: Drift Velocity, Audit Sample flag, Drift Anomaly flag