Skip to content

Live Event Stream

1. Live Event Stream

The Live Event Stream is a continuously updating log of every drift event processed by the Theseus Guard engine. It is the most granular view of real-time AI interaction telemetry available in the platform.

1.1 Event Table

Each row in the event table represents a single guarded AI interaction. Columns include:

Column Description
Event ID Unique identifier for the event (monospaced, copyable)
Guard Target The name of the Guard kernel that evaluated this interaction
L1 Divergence The semantic shift score (0–1) computed by the L1 engine. Visualized as a score bar with a threshold indicator at 0.5
L2 Confidence The L2 classifier's confidence score (0–1) in its verdict. Score bar with threshold at 0.4
L3 Badge indicating whether the L3 TG-Sentinel LLM evaluator was triggered for this event
Verdict The final enforcement verdict: compliant, drift, rejected, or pending
Date Timestamp of the event (UTC)

A LIVE indicator in the page header confirms that the stream is receiving real-time data.

The FilterBar allows operators to narrow the event stream by:

  • Search by Event ID — Find a specific event by its unique identifier
  • Guard — Filter events processed by a specific guard kernel
  • Verdict — Filter by enforcement outcome (compliant, drift, pending, rejected)
  • L3 Escalation — Show only events that triggered L3 evaluation, or only those that did not

1.3 Pagination & Sorting

The event table is paginated (15 events per page) and supports column-level sorting on:

  • Guard Target
  • L1 Divergence
  • L2 Confidence
  • Verdict
  • Date

Keyboard navigation is enabled — arrow keys can move between rows.

1.4 Event Detail (Side Sheet)

Clicking any event row opens a side sheet with the full event detail, organized across three tabs:

Summary Tab

  • Event verdict badge and unique event ID
  • Event Summary grid: timestamp, guard name, tenant ID, origin IP, model, template used
  • Watchpoints: any named behavioral flags that were triggered by this interaction
  • Force Route to Review button (hidden for viewer role) — manually escalates the event into the Runtime Reviews queue

Payload Tab

  • Request Payload — The full request body sent to the AI model, rendered as an interactive property tree
  • Response Payload — The AI-generated response as captured at enforcement time
  • Metadata — Any additional context attached to the event (expandable/collapsible tree viewer)

Analysis Tab

  • Analysis Scores: L1 Divergence, L2 Confidence, L3 Confidence (if triggered), SSC Severity — each visualized as a score bar
  • L2 Reasoning — The textual explanation produced by the L2 classifier for its verdict
  • L3 Reason — The LLM evaluator's reasoning for its escalation decision
  • L3 Escalation Reason — The specific trigger that caused L3 escalation, shown with a severity badge
  • Derived Metrics: Drift Velocity, Audit Sample flag, Drift Anomaly flag